Plaintext Size Limit for ECIES with AES-128 CBC mode

Using the ECIES (Elliptic Curve Integrated Encryption Scheme), is there a limit size of plaintext? (what is the maximum allowed number of bytes to be encrypted with ECIES).

• ECIES : Diffie-Hellman key exchange, coupled with a symmetric encryption scheme, and a MAC. You are free to choose the symmetric encryption scheme. So which one do you want to use. – kelalaka Jan 16 at 16:22
• The symmetric encryption used by ECIES is the AES with CBC (Cipher.getInstance(”ECIESwithAES-CBC”, new BouncyCastleProvider());). The other parameters of ECIES, the MAC key size is 128 bits, and the block cipher key size is 128 bits (IESParameterSpec param = new IESParameterSpec(x, y,128, 128, new byte[16]);). – SAliaMunch Jan 16 at 16:53

You are using CBC mode in ECIES. In the CBC mode the $$i$$-th ciphertext is calculated as

$$c_i = E_k(m_i \oplus c_{i-1})$$

where the $$c_0=IV$$

Now, there is a problem with CBC mode that is if the adversary can see that $$c_i = c_j$$ for some $$i,j$$ with $$i \neq j$$ then they can calculate:

$$m_i \oplus c_{i-1} = m_j \oplus c_{j-1}$$

and by x-oring both sides they can learn

$$m_i \oplus m_j = c_{i-1} \oplus c_{j-1}.$$

This is ciphertext collision and the probability is given by the birthday bound, $$\mathcal{O}(\sqrt{2^n})$$, where the $$n$$ is the block size. So it is not advisable to have more than $$2^{64}$$ blocks. But in practice, you may reduce this into lower sizes to reduce the change of this attack from 50% to your target security level.