3
$\begingroup$

what is the capacity of AES in terms of File Encryption? is it really good to encrypt a large files in AES? ex. I am encrypting a 8GB of File... is it still good to used AES? is it still good to used AES-OFB in encryption of large files?

What also will be the issue if I used AES-ECB in file encryption? is the only issue will be the odds of having a same 128-bit block of data?

| improve this question | |
$\endgroup$
  • $\begingroup$ This is a single 8GB file? Is authentication of the file a concern? Given that OFB is a streaming mode, I would think authentication is necessary. $\endgroup$ – mikeazo Jun 26 '12 at 15:08
  • $\begingroup$ what do you mean by the authentication of a file? $\endgroup$ – goldroger Jun 26 '12 at 15:14
  • $\begingroup$ yes, example there is a 8GB of file.. what authentication do I need? $\endgroup$ – goldroger Jun 26 '12 at 15:18
  • 1
    $\begingroup$ See Authenticated Encryption $\endgroup$ – mikeazo Jun 26 '12 at 16:25
7
$\begingroup$

The capacity of AES in terms of file encryption is practically unlimited for the time being, especially in OFB or CTR mode.

An 8 GB file comprises short of $2^{29}$ 128-bit AES blocks. If one uses CBC or OFB CFB mode, odds of a collision (that is, the same block appearing in ciphertext, which reveals 128 bit worth of potentially usable information about the plaintext) are about $2^{2\cdot 29-129}=2^{-71}$. For comparison, odds of dying by car accident while driving a hundred miles in the US in 2010 have been $2^{-20.0}$.

Cisco gives 2011's IP traffic as about 30 EB/month. Over a year that's about $2^{64.3}$ 128-bit AES blocks, close to the threshold $\sqrt{\pi/2}\cdot2^{64}$ of the expected number of blocks before a collision occurs, again when encrypting in CBC or OFB CFB mode with the same key for the whole data.

Correction (thanks to poncho): If one uses OFB, the important event is not ciphertext collision, it is that the iterated enciphering of the IV loops back to the IV and enters a cycle (which means that from that point onwards, each additional ciphertext bit leaks one bit of information on the plaintext, a seriously damaging event). This has odds $2^{j-128}$ of occurring within $2^j$ blocks, thus less than $2^{-99}$ for that 8GB file, and less than $2^{-63.5}$ for the year's worth of IP traffic (or about $n$ times that if $n$ encryption units using the same key and a random IV are used). For more information on collision probabilities as they apply to OFB, see the classic Random Mapping Statistics.

Update: And if collisions are a worry, there remains CTR mode, which is good for $2^{128}$ blocks without collisions (or $\lfloor2^{128}/n\rfloor$ blocks per encryption units, for $n$ units using the same key, and for unit $j$ an IV set to $j\cdot\lfloor2^{128}/n\rfloor$).

| improve this answer | |
$\endgroup$
  • 6
    $\begingroup$ The calculation of the same block appearing in the ciphertext is correct for CBC mode. For OFB, that's not the important event (as the attacker would learn nothing if he does find two identical ciphertexts); the relevent event is if the same internal state occurs twice. That has a much smaller probability: $2^{29-128} = 2^{-99}$. However, if it does occur, the results are far more drastic; that means that the keystream would have a short cycle, and so the attacker could potentially get a great deal of information about the plaintext. $\endgroup$ – poncho Jun 27 '12 at 14:38
  • $\begingroup$ @poncho: I revised my answer. Thanks again for that important correction. $\endgroup$ – fgrieu♦ Jun 28 '12 at 7:10
7
$\begingroup$

If you mean how much data can safely be encrypted by AES with a single key (and IV), AES is designed to encrypt up to $2^{64}$ blocks of data before becoming susceptible to certain statistical attacks (in particular distinguishing the encrypted file from truly random data), because of its 128-bit block size. 8GB (= $2^{36}$ bits = $2^{29}$ blocks) is quite below this limit, you are fine.

That said, AES-OFB alone is not enough, as it is a streaming mode the plaintext can be altered rather trivially assuming it is partially known beforehand. You will want something like a HMAC on top to ensure the file does not get corrupted by an attacker at some point (note that this does not mean a block mode like CBC does not need one - it does, but plaintext cannot be altered in such predictable ways)

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ Thomas, where did you get this? do you have a link? or a pdf file about this? $\endgroup$ – goldroger Jun 27 '12 at 11:45
  • $\begingroup$ Which paragraph? The first one is a generic attack based on the birthday paradox, which I can detail in my answer if you wish, the second paragraph is because OFB (or any streaming mode in general) provides no authentication at the bit level (block modes provide authentication at the block level but no further). To obtain full authentication you need some sort of MAC (message authentication code). $\endgroup$ – Thomas Jun 27 '12 at 11:57
  • $\begingroup$ at the first paragraph, I want to know why is it 2^64 is the only capacity of AES to encrypt a block of data... $\endgroup$ – goldroger Jun 27 '12 at 12:04
  • $\begingroup$ See fgrieu's answer, he explains in more detail why the limit is not theoretically unlimited. Basically, as you encrypt more and more data with the same key, patterns start to show up which reveal information about the nature of the encryption and the plaintext. $\endgroup$ – Thomas Jun 27 '12 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.