9
$\begingroup$

On https://www.gnupg.org/faq/gnupg-faq.html#define_cast, it says that

Like 3DES, its 64-bit block size means it should not be used to encrypt files larger than 4Gb in size…

How and why does the block size affect the security of the cipher?

$\endgroup$
  • 3
    $\begingroup$ This limit (which can be e.g. 4GB, depends on what chance of collision you are willing to risk) is per key. Therefore this limit is only if single key per encrypted file is used. Similarly, if multiple files are encrypted with same key, the upper bound is not size of any single file, but the size of the files combined. $\endgroup$ – user4982 Sep 29 '14 at 16:35
  • 1
    $\begingroup$ @user4982 Yes, but GPG usually creates a data or session key per file, and encrypts that with the public key of the intended receiver. So in that case it's per file again. $\endgroup$ – Maarten Bodewes Sep 29 '14 at 17:32
9
$\begingroup$

If you use a key for close to $2^{n/2}$ blocks in CBC mode, then the chance of getting a collision in the ciphertext is getting rather high because of the birthday paradox. As the ciphertext is used as a vector for the next calculation, and since that vector should be unpredictable, you would likely lose confidentiality.

Note that the author seems to have put his mark at about $1 / 148$ as the chance for a collision to occur (see the calculation by fgrieu in the comments). That may be either too low or too high depending on the context. That is if bytes are meant instead of bits, otherwise it would be $1/9445$ - a somewhat more sensible value most of the time, but you would be left with only 512 MiB for a single key.

| improve this answer | |
$\endgroup$
  • $\begingroup$ loose $\mapsto$ lose $\;$ $\endgroup$ – user991 Sep 30 '14 at 8:32
  • 1
    $\begingroup$ When using a 64-bit cipher in CBC mode, odds of collision after 4GiB ($k=2^{29}$ blocks) are $ϵ≈2^{65}/k^2=1/2^7=1/128$ (given that $1≪k≪2^{32}$). That's $ϵ≈1/148$ for 4GB, $ϵ≈1/8192$ for 4Gib, $ϵ≈1/9445$ for 4Gb [Reposted with fix and the whole four possible units that could be meant]. $\endgroup$ – fgrieu Sep 30 '14 at 9:20
  • $\begingroup$ Thank you very much for the warning and the calculations, fgrieu. $\endgroup$ – Maarten Bodewes Sep 30 '14 at 10:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.