amplification by composition: The case of doubly-iterated, ideal ciphers -- On the