Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB.

My case isn't using IPSec, the above is just for comparison.

Assuming a plaintext is encrypted and stored to disk using AES-256 in CBC mode, is there a maximum 'safe' size? Fear not, each plaintext gets its own randomly generated IV. I'm just having a hard time finding what the upper bound is for practicing safe encryption.

share|improve this question
Collisions become likely at about 2^64 blocks. I know of no issues while encrypting reasonable amounts of data. – CodesInChaos Apr 26 '12 at 14:56
up vote 5 down vote accepted

as the previous comment said, due to the birthday paradox/problem, after 2^64 blocks (for block ciphers with 128 bits block size) collisions start to get very likely, the authors of cryptography engineering suggest for CBC "2^32 blocks or so", according to them that leaves a residual risk of 2^-64 that there will be leakage of a full block (when a collision happens in cbc, you leak 128 bits of information about the plaintext)

this is for CBC, of course, other modes of operation have other characteristics.

share|improve this answer
Thanks CodeInChaos and cipher! That makes for a good way to frame the problem of collisions. At around 2^64 blocks, it crosses the 50% probability threshold. That point makes for seemingly high risk and very big messages though. With AES’s 128 bit block size, messages can be up to 64GB before breaking out of the 2^32 block length. This method works well highlighting the risk of unexpected disclosure by collisions in messages that are large (by today’s standards). The probability of birthday collision blocks is still less than one in a million for messages of several hundred petabytes. – bmedward Apr 27 '12 at 18:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.