On https://www.gnupg.org/faq/gnupg-faq.html#define_cast, it says that

Like 3DES, its 64-bit block size means it should not be used to encrypt files larger than 4Gb in size…

How and why does the block size affect the security of the cipher?

  • 3
    $\begingroup$ This limit (which can be e.g. 4GB, depends on what chance of collision you are willing to risk) is per key. Therefore this limit is only if single key per encrypted file is used. Similarly, if multiple files are encrypted with same key, the upper bound is not size of any single file, but the size of the files combined. $\endgroup$
    – user4982
    Commented Sep 29, 2014 at 16:35
  • 1
    $\begingroup$ @user4982 Yes, but GPG usually creates a data or session key per file, and encrypts that with the public key of the intended receiver. So in that case it's per file again. $\endgroup$
    – Maarten Bodewes
    Commented Sep 29, 2014 at 17:32

1 Answer 1


If you use a key for close to $2^{n/2}$ blocks in CBC mode, then the chance of getting a collision in the ciphertext is getting rather high because of the birthday paradox. As the ciphertext is used as a vector for the next calculation, and since that vector should be unpredictable, you would likely lose confidentiality.

Note that the author seems to have put his mark at about $1 / 148$ as the chance for a collision to occur (see the calculation by fgrieu in the comments). That may be either too low or too high depending on the context. That is if bytes are meant instead of bits, otherwise it would be $1/9445$ - a somewhat more sensible value most of the time, but you would be left with only 512 MiB for a single key.

  • $\begingroup$ loose $\mapsto$ lose $\;$ $\endgroup$
    – user991
    Commented Sep 30, 2014 at 8:32
  • 1
    $\begingroup$ When using a 64-bit cipher in CBC mode, odds of collision after 4GiB ($k=2^{29}$ blocks) are $ϵ≈2^{65}/k^2=1/2^7=1/128$ (given that $1≪k≪2^{32}$). That's $ϵ≈1/148$ for 4GB, $ϵ≈1/8192$ for 4Gib, $ϵ≈1/9445$ for 4Gb [Reposted with fix and the whole four possible units that could be meant]. $\endgroup$
    – fgrieu
    Commented Sep 30, 2014 at 9:20
  • $\begingroup$ Thank you very much for the warning and the calculations, fgrieu. $\endgroup$
    – Maarten Bodewes
    Commented Sep 30, 2014 at 10:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.