# How much data can we encrypt using AES 256 before changing the key?

Although this question has been answered in this link (After How Much Data Encryption (AES-256) we should change key?), I am not satisfied with the answers because the Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM)and GMAC has a different view on this. It says

Now 2^32 block ciphers, means 2^32 * 16 bytes of data, which is approximately 68 GBs. So do I need to change keys after 68 GBs? I am confused because I am very new to the field and I would be very thankful for any help or suggestion in this regard.

The "Birthday bound" of an n-bit value is $$2^\frac{n}{2}$$, so a 96-bit IV has a bound of only $$2^\frac{96}{2}=2^{48}$$ blocks. But both recommended IV constructions keep some bits of the IV fixed, resulting in the lowered block count recommendation. EG
means that only 64 bits of the IV would vary, so $$2^\frac{64}{2}=2^{32}$$ blocks can be safely encrypted with those GCM settings. Other IV generation methods similarly tend to reduce the number of varying bits. Fixing some bits allows for multiple sources to encrypt data using the same key. If one bit is fixed, two devices can share a key. If two bits are fixed, 4 devices can. Etc. If no bits are fixed, then each device must have its own send and receive key for each other device. Since this part of the spec is about fixed, shared keys the storage requirements would quickly overwhelm small systems.
Schneier et.al. recommend $$2^{32}$$ blocks with CBC and $$2^{60}$$ blocks with CTR mode. However, later research said that CTR mode was about as leaky as CBC mode so you may want to limit yourself to $$2^{32}$$ blocks with that mode too. See https://eprint.iacr.org/2018/159.pdf