Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does redundancy in a file or data effect performance and security of encryption? (for example for AES, if not for general case)

Is it easier to encrypt something that has high redundancy or something that has almost no redundancy?

And does redundancy makes security weaker by any means?

share|improve this question
Proper encryption doesn't notice redundancy. You're putting in a bunch of bytes, getting out a bunch of bytes and runtime only depends on the length of the input. – CodesInChaos Oct 8 '13 at 16:42
up vote 5 down vote accepted

Pretty much all modern encryption systems (including AES, in any standard mode) are data-agnostic: they are designed to encrypt any byte (or bit) stream regardless of its content, and their performance does not depend in any way on what the stream contains.

Indeed, if this were not the case, that would open the encryption scheme to timing attacks — if the performance of the encryption system depended on the data being encrypted, an attacker would be able to learn something about the data by timing how long it takes to encrypt it. Modern encryption systems are designed to avoid such attacks, primarily by ensuring that their performance is constant regardless of the data being encrypted or the key used.

(That said, ensuring that the execution time of an encryption routine remains perfectly constant can be difficult, and it's not at all uncommon for timing attacks to be discovered against insufficiently careful implementations of even standard crypto algorithms. This is one reason why writing secure low-level crypto code requires a lot of skill and attention to detail. However, even when such vulnerabilities exist, they're typically a lot more subtle than what you describe.)

As for security, modern encryption schemes are also supposed to be secure regardless of the data being encrypted. Indeed, the minimum level of security typically expected of a secure encryption scheme is ciphertext indistinguishability under a chosen-plaintext attack (IND-CPA), which requires that, even if the attacker gets to choose the messages being encrypted, he still cannot distinguish the encrypted output from a random bitstring (of equal length).

That said, while encryption systems in current use (such as AES, in any secure mode) are assumed to meet this level of security, and while no-one currently knows (or at least has published) any attacks that would violate that claim, no-one has also ever managed to unconditionally prove that any encryption scheme actually meets that standard, and sometimes new attacks do get discovered against systems previously thought to be secure. If an encryption system is sufficiently badly broken, it is possible that the nature of the data being encrypted might affect the ability of an attacker to exploit the system's weakness. That said, any system for which that would be the case would be regarded as hopelessly insecure and unsuitable for use today.

share|improve this answer
So, if one wants to compare (performance, energy-efficiency) two data-agnostic cipher, the type of data in the input file will not matter? – Armen Oct 8 '13 at 21:33
Exactly.​​​​​​​ – Ilmari Karonen Oct 8 '13 at 22:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.