c# - Does encapsulating one CryptoStream in several others improve security? -

i'm working on project windows phone 7 stores highly secure information. data protected password. if encrypt 1 cryptostream within 3 other cryptostreams (a total of 4 cryptostreams embedded in each other, each using different methods generate key, initialization vector, , salt). method secure enough, or need more cryptostreams (each 1 uses 256 bit aes encryption)?

it far more brute force or socially engineer password crack singly-encrypted stream since password have smaller bitspace key. encrypting multiple times increase time or effort required brute force password o(n) (you want complexity increase o(n^2) or more).

but if need super-secure encryption, don't roll own strategy, pick dod standard (or equivalent) , implement it.

---

to explain further, aes block cipher 3 different key lengths. first part of strategy determining key length want use. pick 1 @ random, or pick largest, want pick best choice situation. next actual usage of aes. since it's block cipher encode identical plaintext identical ciphertext, want use initialization vector , salt , other such techniques ensure plaintext become different ciphertext.

then there's how derive key password, may weak. if generate key each time, may have accidentally narrowed keyspace , weakened it. have take account random number generator used, may produce predictable values. if use password unlock key storage in way, data protected key store. if fetch key remotely upon successful receipt of password, you've prevented off-line attacks of data , can actively detect brute-force attacks.

finally there's aspect of password itself, far weakest point of encryption strategy. doesn't matter how many ciphers use if user picks weak password. that's why if encrypt data single 128-bit aes encryption it's more attacker attempt compromise password try break encryption.

picking set of strategies have been tested serve better coming own, unless plan spend requisite money on penetration testing , security audits.

---

for fun, read on how truecrypt it.