In https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf page 27, it is said that

...the total number of blocks of plaintext and AAD that are protected by invocations of the authenticated encryption function during the lifetime of the key should be limited. A reasonable limit for most applications would be $2^{64}$...

I could not find any reason for this. What will happen if I encrypt more than $2^{64}$ messages with the following settings

  1. The same key is used
  2. The tag length is 128-bit
  3. IV length is 96-bit
  4. Unique IV is chosen for each message
  5. Each message has less than 2^32 blocks

What is the attack? What is the security level of my setting...


1 Answer 1


If you encrypt 264 blocks or more than an attacker can forge encrypted data, i.e. you lose authentication.

Also, be careful about how much total data you encrypt with a key (no matter how many unique IVs are used). Schneier, et.al. once recommended that with CBC mode you encrypt at most 232 blocks, but with CTR mode you could go to 260 or so blocks due to the fact that you didn't have to worry about reusing IVs with CTR mode like you do with CBC mode (birthday problem). However, subsequent research suggests that the limit for CTR mode is the same as CBC mode, see this. However, it depends on how long the data needs to remain secure and your tolerance of risk. If you want to encrypt data for tape and it needs to be secure for 30 years without being re-encrypted you might want to greatly lower than amount to 220blocks.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.