|
IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB. My case isn't using IPSec, the above is just for comparison. Assuming a plaintext is encrypted and stored to disk using AES-256 in CBC mode, is there a maximum 'safe' size? Fear not, each plaintext gets its own randomly generated IV. I'm just having a hard time finding what the upper bound is for practicing safe encryption. |
|||||
|
|
as the previous comment said, due to the birthday paradox/problem, after 2^64 blocks (for block ciphers with 128 bits block size) collisions start to get very likely, the authors of cryptography engineering suggest for CBC "2^32 blocks or so", according to them that leaves a residual risk of 2^-64 that there will be leakage of a full block (when a collision happens in cbc, you leak 128 bits of information about the plaintext) this is for CBC, of course, other modes of operation have other characteristics. |
||||
|
