I use AES-CBC and HMAC-SHA256 to encrypt a text file. Will the output be larger in size than the input or will it be the same size?

Is it more secure secure if the size of the output is larger?


AES CBC usually requires padding, such as PKCS#7 padding. This padding is 1 to 16 bytes, 16 being the block size of AES. The HMAC will add 256 / 8 = 32 bytes to the total. Usually you will need to store the randomized IV as well with ciphertext, to allow for reuse of the key, adding another 16 bytes (the block size again). So the total overhead will be about 16 + 16 + 32 = 64 bytes.

You can shave some bytes off of this by using a smaller tag, but don't go below 8 bytes, the more bytes the more security the tag will provide. You can also use a different scheme and calculate the IV instead of sending all of the IV bytes, as long as the IV is unpredictable to an attacker. You may also be able to deploy ciphertext stealing (CTS) to avoid the padding overhead, but not many libraries contain ciphertext stealing in their implementations of AES-CBC.

With an authentication tag provided by the HMAC you will increase the size, and this will of course enhance your security; it adds integrity and authenticity and may even protect confidentiality if (padding) oracle attacks are feasible.

Don't forget to include the IV information in the authentication tag, and perform the HMAC over the ciphertext instead of the plaintext.

| improve this answer | |
  • $\begingroup$ AES-GCM only requires one key, can use an (8 byte?) nonce directly instead of a full IV and the authentication tag size is configurable. Furthermore, it is much faster. More dangerous in use, but it has some advantages. If you want easy security with less speed advantages, use EAX mode (availability may vary). $\endgroup$ – Maarten Bodewes Nov 18 '14 at 22:56
  • $\begingroup$ so, usually how larger is the output compared with the input? $\endgroup$ – joewruou Nov 18 '14 at 22:58
  • $\begingroup$ That's called overhead and it is in the answer. I've taken the liberty to use the maximum padding size. You may bring it down to 32 bytes if you use a 8 byte tag and 8 byte input to calculate the IV. That is of course if you just concatenate everything, no additional structure specified. $\endgroup$ – Maarten Bodewes Nov 18 '14 at 22:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.