Using the ECIES (Elliptic Curve Integrated Encryption Scheme), is there a limit size of plaintext? (what is the maximum allowed number of bytes to be encrypted with ECIES).

  • $\begingroup$ ECIES : Diffie-Hellman key exchange, coupled with a symmetric encryption scheme, and a MAC. You are free to choose the symmetric encryption scheme. So which one do you want to use. $\endgroup$ – kelalaka Jan 16 '19 at 16:22
  • $\begingroup$ The symmetric encryption used by ECIES is the AES with CBC (Cipher.getInstance(”ECIESwithAES-CBC”, new BouncyCastleProvider());). The other parameters of ECIES, the MAC key size is 128 bits, and the block cipher key size is 128 bits (IESParameterSpec param = new IESParameterSpec(x, y,128, 128, new byte[16]);). $\endgroup$ – SAliaMunch Jan 16 '19 at 16:53

You are using CBC mode in ECIES. In the CBC mode the $i$-th ciphertext is calculated as

$$c_i = E_k(m_i \oplus c_{i-1})$$

where the $c_0=IV$

Now, there is a problem with CBC mode that is if the adversary can see that $c_i = c_j$ for some $i,j$ with $i \neq j$ then they can calculate:

$$m_i \oplus c_{i-1} = m_j \oplus c_{j-1}$$

and by x-oring both sides they can learn

$$m_i \oplus m_j = c_{i-1} \oplus c_{j-1}.$$

This is ciphertext collision and the probability is given by the birthday bound, $\mathcal{O}(\sqrt{2^n})$, where the $n$ is the block size. So it is not advisable to have more than $2^{64}$ blocks. But in practice, you may reduce this into lower sizes to reduce the change of this attack from 50% to your target security level.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.