Skip to main content

🔧 Building Your Tower

Stacking Cipher Layers​

In 10 minutes: Setting up multiple encryption layers
Prerequisite: Understanding cipher layers

🎯 The Simple Story​

Imagine building a tower of protection:

Tower (Layered Protection Layer by Layer):

🏗️ Layer 3 (Top Layer): MLS (Meeting Room)
   └─ Protects: Group chats
   └─ Threat: Eve joining group

🏗️ Layer 2: Signal (Two-Person Phone Booth)
   └─ Protects: Private messages
   └─ Threat: Past message compromise

🏗️ Layer 1: AES (Safe Deposit Box)
   └─ Protects: Simple files
   └─ Threat: Single lock picked

🏗️ Layer 0: Plaintext (Your Treasure)
   └─ Base layer: Your data

Key principle: Order matters!

  • Encryption: Bottom layer first (AES → Signal → MLS)
  • Decryption: Top layer first (MLS → Signal → AES)

🧠 Mental Model​

Hold this picture in your head:


Layer Ordering (Building the Tower):

Bottom layer (First encrypt):
┌──────────────────────────┐
│  AES Cipher Layer            │ ← Start here!
│  Fast, simple, password-based  │
└──────────────────────────┘
       ↓ Build on top...
Middle layers:
┌──────────────────────────┐
│  Signal Cipher Layer         │
│  Two-person encryption        │
│  Forward secrecy (keys delete!)│
└──────────────────────────┘
       ↓ Build on top...
Top layer (Last encrypt):
┌──────────────────────────┐
│  MLS Cipher Layer             │
│  Group encryption            │
│  Meeting room metaphor        │
└──────────────────────────┘
       ↓
Top: Final ciphertext!

Plaintext → AES → Signal → MLS → Final

Think of it like building:

  • AES = Foundation (base)
  • Signal = Building on top (walls)
  • MLS = Roof on top (ceiling)

You can't have the roof without the walls! Your castle goes: Foundation → Walls → Roof!

📊 Order Matters​

Why Order Matters?​

Bottom (first encrypt): AES
└─ Why? Fast, simple, password-based

Middle (next encrypt): Signal, DH
└─ Why? Handshakes and forward secrecy
└─ Note: These don't require group context

Top (last encrypt): MLS, ML-KEM
└─ Why? These need specific context!
  - MLS: Group ID, member list
  - ML-KEM: Public/private key pair

Rule of thumb:

  • Fast/lower layers first (AES, DH)
  • Complex/context-dependent layers last (Signal, MLS, ML-KEM)

🎭 The Story: Alice's Encryption Castle​

Alice is building her security castle to protect her secrets (messages).

Wrong Way: Random Ordering​

Alice's Castle (WRONG ORDER):

Layer 1: MLS (Top) ← Starts here!
└─ Problem: Needs group context!
└─ Alice hasn't built the group yet!

Layer 2: Signal (Middle)
└─ Problem: Needs double ratchet state!
└─ Alice hasn't established it yet!

Layer 3: AES (Bottom)
└─ Added last but used first

Result: Can't build on top! Foundation missing!

Alice: "I can't build the roof without walls!"

Right Way: Foundation First​

Alice's Castle (RIGHT ORDER):

Layer 1: AES (Foundation) ← Start here!
├─ Simple password encryption
└─ Easy to add (just needs password)

Layer 2: Signal (Walls)
├─ Build on AES foundation
└─ Add double ratchet next

Layer 3: MLS (Roof)
├─ Build on Signal walls + AES foundation
└─ Add group context on top

Alice: "Perfect! Foundation → Walls → Roof!"

🏗️ Adding Layers with CascadingCipherManager​

import { CascadingCipherManager, AESCipherLayer } from "cryptography/CascadingCipher";

// Step 1: Create manager
const manager = new CascadingCipherManager();

// Step 2: Add layers IN ORDER:

// Foundation (layer 0)
manager.addLayer(new AESCipherLayer());
// Why first? Simple, fast, no dependencies!

// Walls (layers 1-2)
manager.addLayer(new DHCipherLayer());
manager.addLayer(new SignalCipherLayer(signalWasm));

// Roof (layer 3)
manager.addLayer(new MLSCipherLayer(mlsManager, groupId));
// Why last? Needs group context!

⚠️ Common Ordering Mistakes​

Mistake 1: Fast Layers Last​

WRONG:
manager.addLayer(MLSCipherLayer);  ← Top - needs context!
manager.addLayer(AESCipherLayer);   ← Bottom - was simple but last

Problem:

  • MLS tries to encrypt but doesn't have group context
  • Manager can't find Group ID
  • ERROR!

FIX:

manager.addLayer(AESCipherLayer());   // Add FIRST!
manager.addLayer(MLSCipherLayer());  // Add LAST!

Mistake 2: Layers Need Dependencies​

WRONG:
manager.addLayer(MLSCipherLayer);      ← Needs MLSManager
manager.addLayer(SignalCipherLayer());   ← Needs Signal state
// Neither layer has their dependencies!

FIX:
mlsManager = await initialize();
const signalWasm = await loadSignalWasm();

manager.addLayer(AESCipherLayer());
manager.addLayer(SignalCipherLayer(signalWasm));
manager.addLayer(MLSCipherLayer(mlsManager));

🎮 Try It Yourself​

Question 1: Which order is better and why?

Show Answer This

Option A: MLS → Signal → AES Option B: AES → DH → Signal

Answer: Option B (Option A) WRONG!

Why? MLS and Signal both depend on context but in different ways:

  • MLS needs: Group ID, member list initialized
  • Signal needs: Double ratchet state established

If MLS or Signal layers are added before AES or DH, they try to encrypt but can't find what they need! AES and DH don't need dependencies - they're simpler!

Correct order: AES → DH → Signal → MLS

Question 2: Can you reorder layers? What happens?

Answer: Yes! But you can't decrypt old ciphertext after reordering because the order changed! Old ciphertext expects Layer 1 → Layer 2. New order is Layer 2 → Layer 1. If you try to decrypt old ciphertext with new order, Layer 1⁻¹ expects data it never got! You need to re-encrypt all your data if you change order!

Question 3: What's the general rule for layer ordering?

Answer: Order from simple/dependency-free to complex/context-dependent:

Simple layers first (no dependencies:

  • AES (just password)
  • DH (just keys, optional shared secret)

Middle layers next (light dependencies:

  • Signal (needs ratchet state)

Complex layers last (many dependencies:

  • MLS (needs group context)
  • ML-KEM (needs key pairs)

💡 Real-World Example: Secure Chat App​

Layer ordering in a secure messaging app:

// Initial key exchange (first)
manager.addLayer(new DHCipherLayer());

// Add forward secrecy for 2-person chats (second)
manager.addLayer(new SignalCipherLayer(wasmModule));

// Add quantum resistance (third)
manager.addLayer(new MLKEMCipherLayer());

// Add fast simple layer for compatibility (optional, fourth)
manager.addLayer(new AESCipherLayer());

// Result: DH → Signal → ML-KEM → AES

Layer purposes:

  • DH: Establish initial shared secret
  • Signal: Forward secrecy for 2-person messaging
  • ML-KEM: Quantum-resistant protection
  • AES: Compatibility, backup layer

✅ Quick Check​

**Can you explain layer ordering to a 5-year-old?

Try saying this out loud:

"Imagine building a house! You don't put the roof on first! You start with the foundation, then build the walls, then put the roof on last. It's the same with encryption layers. Build the simple layers first (like AES), then the harder ones (like Signal and MLS) on top!"

🎓 Key Takeaways​

✅ Order matters - Foundation first, then walls, then roof
✅ Simple layers first - AES, DH (no dependencies)
✅ Complex layers last - Signal, MLS, ML-KEM (need context)
✅ Dependencies check - Ensure layers have what they need
✅ Don't change order - Old ciphertexts can't decrypt with new order!
✅ General rule: Simple → Complex layers

Now you know how to order layers. Next: Using the layer manager!