2
$\begingroup$

Although this question has been answered in this link (After How Much Data Encryption (AES-256) we should change key?), I am not satisfied with the answers because the Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM)and GMAC has a different view on this. It says

enter image description here

Now 2^32 block ciphers, means 2^32 * 16 bytes of data, which is approximately 68 GBs. So do I need to change keys after 68 GBs? I am confused because I am very new to the field and I would be very thankful for any help or suggestion in this regard.

$\endgroup$
1
1
$\begingroup$

AES-GCM is not the same thing as AES. AES-GCM uses a 96-bit IV, or transforms a non-96-bit IV into a 96-bit IV before use. The particular constraints of the RBG and Deterministic constructions mean that not all of those 96 bits are expected to change between invocations. An IV collision (two uses of the same IV with a given key) is catastrophic to GCM's security, and therefore must be avoided.

The "Birthday bound" of an n-bit value is $2^\frac{n}{2}$, so a 96-bit IV has a bound of only $2^\frac{96}{2}=2^{48}$ blocks. But both recommended IV constructions keep some bits of the IV fixed, resulting in the lowered block count recommendation. EG

this Recommendation suggests, but does not require, that the leading (i.e., leftmost) 32 bits of the IV hold the fixed field; and that the trailing (i.e., rightmost) 64 bits hold the invocation field

means that only 64 bits of the IV would vary, so $2^\frac{64}{2}=2^{32}$ blocks can be safely encrypted with those GCM settings. Other IV generation methods similarly tend to reduce the number of varying bits. Fixing some bits allows for multiple sources to encrypt data using the same key. If one bit is fixed, two devices can share a key. If two bits are fixed, 4 devices can. Etc. If no bits are fixed, then each device must have its own send and receive key for each other device. Since this part of the spec is about fixed, shared keys the storage requirements would quickly overwhelm small systems.

$\endgroup$
1
0
$\begingroup$

In general, it ends up being mode specific, but as it turns out the limit generally is about 64 GB, though it also depends on your risk tolerance.

Schneier et.al. recommend $2^{32}$ blocks with CBC and $2^{60}$ blocks with CTR mode. However, later research said that CTR mode was about as leaky as CBC mode so you may want to limit yourself to $2^{32}$ blocks with that mode too. See https://eprint.iacr.org/2018/159.pdf

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.