3

what is the capacity of AES in terms of File Encryption? is it really good to encrypt a large files in AES? ex. I am encrypting a 8GB of File... is it still good to used AES? is it still good to used AES-OFB in encryption of large files?

What also will be the issue if I used AES-ECB in file encryption? is the only issue will be the odds of having a same 128-bit block of data?

goldroger
  • 1,737
  • 8
  • 33
  • 41

2 Answers2

7

If you mean how much data can safely be encrypted by AES with a single key (and IV), AES is designed to encrypt up to $2^{64}$ blocks of data before becoming susceptible to certain statistical attacks (in particular distinguishing the encrypted file from truly random data), because of its 128-bit block size. 8GB (= $2^{36}$ bits = $2^{29}$ blocks) is quite below this limit, you are fine.

That said, AES-OFB alone is not enough, as it is a streaming mode the plaintext can be altered rather trivially assuming it is partially known beforehand. You will want something like a HMAC on top to ensure the file does not get corrupted by an attacker at some point (note that this does not mean a block mode like CBC does not need one - it does, but plaintext cannot be altered in such predictable ways)

Paŭlo Ebermann
  • 22,946
  • 7
  • 82
  • 119
Thomas
  • 7,568
  • 1
  • 32
  • 45
6

The capacity of AES in terms of file encryption is practically unlimited for the time being, especially in OFB or CTR mode.

An 8 GB file comprises short of $2^{29}$ 128-bit AES blocks. If one uses CBC or OFB CFB mode, odds of a collision (that is, the same block appearing in ciphertext, which reveals 128 bit worth of potentially usable information about the plaintext) are about $2^{2\cdot 29-129}=2^{-71}$. For comparison, odds of dying by car accident while driving a hundred miles in the US in 2010 have been $2^{-20.0}$.

Cisco gives 2011's IP traffic as about 30 EB/month. Over a year that's about $2^{64.3}$ 128-bit AES blocks, close to the threshold $\sqrt{\pi/2}\cdot2^{64}$ of the expected number of blocks before a collision occurs, again when encrypting in CBC or OFB CFB mode with the same key for the whole data.

Correction (thanks to poncho): If one uses OFB, the important event is not ciphertext collision, it is that the iterated enciphering of the IV loops back to the IV and enters a cycle (which means that from that point onwards, each additional ciphertext bit leaks one bit of information on the plaintext, a seriously damaging event). This has odds $2^{j-128}$ of occurring within $2^j$ blocks, thus less than $2^{-99}$ for that 8GB file, and less than $2^{-63.5}$ for the year's worth of IP traffic (or about $n$ times that if $n$ encryption units using the same key and a random IV are used). For more information on collision probabilities as they apply to OFB, see the classic Random Mapping Statistics.

Update: And if collisions are a worry, there remains CTR mode, which is good for $2^{128}$ blocks without collisions (or $\lfloor2^{128}/n\rfloor$ blocks per encryption units, for $n$ units using the same key, and for unit $j$ an IV set to $j\cdot\lfloor2^{128}/n\rfloor$).

fgrieu
  • 149,326
  • 13
  • 324
  • 622