# How is the plaintext to ciphertext expansion ratio on AES cipher?

My understanding for AES cipher is just mapping a plaintext of a some length to a ciphertext of the same length.

Is the ratio always |Ciphertext|/|Plaintext| = 1?

Please correct me if you have noticed something. I may luck some assumptions.

• Are you talking about whether this ratio is possible or whether it is sensible? Also are you talking about this ratio as a limit of increasingly longer messages or in absolute terms?
– SEJPM
Apr 6 '18 at 18:05

## AES as a block cipher

AES is a block cipher. Since it is invertible, there must be a one-to-one mapping between plaintext and ciphertext blocks. So when talking about a single block, the ratio of ciphertext to plaintext is indeed $1$.

## Ciphers and modes of operation

However, a block cipher is not a complete cipher. In order to encrypt quantities of information greater than the block size and/or to encrypt the same plaintext while maintaining indistinguishability, you have to use a mode of operation.

A mode of operation requires an initialization vector, which will add a constant amount of size overhead to the size of the cryptogram. Different use cases and modes of operation can support/require varying minimum IV sizes. IV sizes of 96 to 256 bits are common.

A proper mode of operation includes authentication and integrity of the ciphertext, as well as associated data. The authentication tag will also contribute to the size overhead. Tags can vary in size depending on the application. Very constrained environments may use tags for short lived data that would be unacceptably short in other environments, while less constrained environments may use tags that would be unacceptably large in other contexts. A tag size of 64 to 256 bits is a reasonable range.

## Conclusion

In the worst case scenario, for AES which has a 128-bit block size, encrypting a single block with an 128-bit IV will double the size of the cryptogram compared to the size of the plaintext, giving a ratio of $2:1$ ciphertext to plaintext size.*

When you include authentication, assuming a 256-bit tag for a single block, then you have a ratio of $4 : 1$.

In the best case scenario, encrypting a very very long message with any sized initialization vector and authentication tag will cause a negligible increase in the size of the cryptogram compared to the size of the plaintext. The ratio of ciphertext to plaintext size will approach $1$ as the size of the plaintext becomes larger.

* It is arguable that encrypting a single bit is the worst case scenario, but this answer concerns itself with a minimum unit of 1 block size.

• A certain french smartcard designer may have more accurate insight as to the minimum size of authentication tags and initialization vectors, the answer above lists reasonable estimates which don't represent the extreme of what is possible. Apr 6 '18 at 18:19
• Thanks for your great answer! Suppose that $λ$ is a security parameter (λ-bit tag in this case), is the following generally correct?|ciphertext| = $O(λ)$|plaintext| Thank you. Apr 7 '18 at 8:48
• @mallea I don't understand your notation. What does $O(\lambda)$|plaintext| mean? If |plaintext| means the size of the plaintext, what does it mean to multiply that by $O(\lambda)$? Apr 7 '18 at 16:21