How much data can I encrypt with AES before I need to change the key in CBC mode?

Question

In my cryptography class, the instructor suggested that in order to give the attacker a minimal advantage of $1/2^{32}$, we have to change the key after $2^{48}$ blocks are encrypted.

It seems that the advantage of $1/2 ^{32}$ is somewhat arbitrarily chosen, and I'm not sure where that comes from. Can anyone explain the reasoning of why this is chosen and when it should be higher or lower than $1/2^{32}$?

My class notes:

CBC: CPA Analysis

$q = $ # of messages encrypted with key $k$
AES uses 128 bit blocks
$L$ = length of the max message

For every adversary $A$ that attacks cbc encryption, there is a PRP adversary $B$ with

$$ Adv[A,E_{cbc}] \leq 2 · Adv[B, E_{prp}] + \overbrace{2 · q^2· L^2 / |X|}^{\text{error term}}$$

So CBC is only secure as long as $q^2·L^2 \ll |X|$.

Example

The error term = $q ^ 2 · L^2 / |X| < 1/2 ^{32}$

AES: $|X| = 2^{128}$ (bits per block) So after $2^{48}$ AES blocks the key needs to be changed.

DES: $|X| = 2^64 \Rightarrow q·L < 2 ^{16}$

Also, the instructor said that DES needed a new key after $2^{16}$ blocks, and he said that means every .5 MB of data requires a change. This is the formula he wrote down, Is this correct? $2^{16} · 8 = 1/2$ MB.

Answer 1

The $1/2^{32}$ is an arbitrary figure, based upon one particular value for what counts as an acceptable risk.

You need to decide what is an acceptable risk. If you think that a $1/2^{32}$ probability of failure is an acceptable risk, then this calculation is relevant to you. If you think it isn't, then decide what you think is an acceptable risk and re-do the calculation based upon the number you think fits your particular situation.

Keep in mind a $1/2^{32}$ probability of failure is pretty darn small -- in many settings, it may be acceptable. It's far more likely that the next time you'll get into a car, you'll end up in a car accident: the probability of that is probably much higher than $1/2^{32}$. Also keep in mind that life is about risk: you can never completely eliminate all risk from your life. So, decide what is an acceptable risk, then you based upon that you can decide how much data you can encrypt under a single key, using a calculation similar to that one shown here.