How to compute the storage cost of encrypted data

Question

Let's say I have (as an example only) 1 MB of plaintexts. I want to encrypt it using symmetric encryption algorithm (e.g. AES) and store the plaintext and ciphertext in a memory space. Does a ciphertext take the same size as its corresponding plaintext? I mean, in my example, does this mean I need 2 MB to store plaintexts and ciphertexts? Can you provide references?

Answer 1

Does a ciphertext take the same size as its corresponding plaintext?

It really depends. From a cryptographic standpoint you can do this, however there are a few pieces of info you really want to be sent along with your message. The overhead thus is constant, i.e. independent of the actual message length. If you go with crazy double-encryption variants or weird custom schemes though you may of course get a linear increase here.

The (interesting) values you may or may not provide with your ciphertext may include the following ones:

• Authentication tag. You really want this one or otherwise you won't be able to verify the integrity of the message you're receiving. Its size usually ranges from 16 (GCM) to 64 bytes (HMAC-SHA-512).
• Nonce / IV. You really want this as otherwise you have no chance of getting actually secure encryption and same messages encrypt to same ciphertexts. The overhead introduced here is around 0 (fully context dependent) to 16 bytes (CBC-IV) usually.
• Scheme identifier. You may want to add an identifier for your scheme used in case your application supports or will support multiple encryption algorithms. The overhead here may reach from a single byte up to a few bytes (OID).
• Structuring. More often than not you want your various data types to be structured as standards-compliant as possible and thus you may want to use something like ASN.1 which also adds a few bytes as overhead (for encoding lengths and types).
• Data encryption keys. Sometimes people also use different keys for the each packet of data to limit the amount of data per key. A data encryption key is then an encrypted key which can decrypt the message content. This overhead of course also depends on all the other listed overheads.
• Other auxilliary data. This may include application-defined content such protocol version and other routing information.

So all in all you tend to be looking at a constant overhead with 32 bytes minimum in size and a few hundred bytes in size maximum.

Answer 2

Your question is too broad in this form.

There are plenty of different symmetric encryption algorithms. Most of them produce 1MB output for 1MB input. Most of them are block-based, so they round up the input size to a multiple of a block-size. If you choose a specific algorithm, you can check the exact details yourselves. You should not choose encryption algorithm based on the overhead though, but rather choose one based on security and performance.

Also, it is usual to compress data before encrypting it, because it is impossible to do so after encryption.