Re: aes/gcm maximum plaintext size; handling of large files

--00000000000014e680063c29eb6d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Aug 12, 2025 at 7:45=E2=80=AFAM Lana Deere <[email protected]> w=
rote:

> Using cryptopp 8.9 on debian 12.11 with gcc 14.2 I have an AES/GCM
> encryption program which I am running on a large file (75GB).  It is
> failing with the error "AES/GCM: message length exceeds maximum".  I
> searched around and found information which suggests the maximum file siz=
e
> should be 2**39-256, which is a bit less than 550GB.  So it is not clear =
to
> me why I am getting this error message.  Any ideas on what kind of bug I
> should be looking for?  As a second question, anyone have any advice on
> ways to handle large files which it is desirable to encrypt?  This is not
> the largest file I would like to encrypt and it is plausible I would hit
> the 2**39-256 limit.
>
> The relevant code looks like this:
>     CryptoPP::GCM<CryptoPP::AES>::Encryption encryptor;
>     encryptor.SetKeyWithIV(reinterpret_cast<const CryptoPP::byte
> *>(key.data())
>                           , KeyBytes
>                           , iv.bytes
>                           , IVBytes
>                           );
>
>     CryptoPP::AuthenticatedEncryptionFilter filter(encryptor);
>
>     CryptoPP::FileSource source(plainfile.c_str(), false);
>     CryptoPP::FileSink sink(cipherfile.c_str());
>
>     CryptoPP::ArraySource(iv.bytes, IVBytes, true, new
> CryptoPP::Redirector(sink));
>
>     source.Attach(new CryptoPP::Redirector(filter));
>     filter.Attach(new CryptoPP::Redirector(sink));
>
>     while (!EndOfFile(source) && !source.SourceExhausted())
>     {
>         source.Pump(TransferBytes);
>         filter.Flush(false);
>     }
>     filter.MessageEnd();
>

GCM plaintext maximum length is specified in bits, not bytes. See
SP800-39D, Section 5.2.1.1 Input Data, p. 8, <
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.p=
df>.
That leads to:

    2^39 - 256 =3D 549755813632
    549755813632 / 8 =3D 68719476704

The limit is declared in gcm.h, <
https://github.com/weidai11/cryptopp/blob/master/gcm.h#L61>. The maximum
plaintext limit is enforced in authenc.cpp, <
https://github.com/weidai11/cryptopp/blob/master/authenc.cpp#L109>.

Jeff

--=20
You received this message because you are subscribed to the Google Groups "=
Crypto++ Users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/cryptopp-us=
ers/CAH8yC8kdtNcJGPmkDBfOSLPAMn6RyNG0uEOEfpYPGgciMWqtww%40mail.gmail.com.

--00000000000014e680063c29eb6d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote g=
mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Aug 12,=
 2025 at 7:45=E2=80=AFAM Lana Deere &lt;<a href=3D"mailto:lana.deere@gmail.=
com">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmai=
l_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,20=
4,204);padding-left:1ex"><div>Using cryptopp 8.9 on debian 12.11 with gcc 1=
4.2 I have an AES/GCM encryption program which I am running on a large file=
 (75GB).=C2=A0 It is failing with the error &quot;AES/GCM: message length e=
xceeds maximum&quot;.=C2=A0 I searched around and found information which s=
uggests the maximum file size should be 2**39-256, which is a bit less than=
 550GB.=C2=A0 So it is not clear to me why I am getting this error message.=
=C2=A0 Any ideas on what kind of bug I should be looking for?=C2=A0 As a se=
cond question, anyone have any advice on ways to handle large files which i=
t is desirable to encrypt?=C2=A0 This is not the largest file I would like =
to encrypt and it is plausible I would hit the 2**39-256 limit.<br></div><d=
iv><br></div><div>The relevant code looks like this:</div><div></div><div>=
=C2=A0<span style=3D"font-family:Courier New"> =C2=A0 CryptoPP::GCM&lt;Cryp=
toPP::AES&gt;::Encryption encryptor;<br>=C2=A0 =C2=A0 encryptor.SetKeyWithI=
V(reinterpret_cast&lt;const CryptoPP::byte *&gt;(key.data())<br>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 , KeyBytes<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 , iv.bytes<br>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 , IVB=
ytes<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 );<br><br>=C2=A0 =C2=A0 CryptoPP::AuthenticatedEnc=
ryptionFilter filter(encryptor);<br><br>=C2=A0 =C2=A0 CryptoPP::FileSource =
source(plainfile.c_str(), false);<br>=C2=A0 =C2=A0 CryptoPP::FileSink sink(=
cipherfile.c_str());<br><br>=C2=A0 =C2=A0 CryptoPP::ArraySource(iv.bytes, I=
VBytes, true, new CryptoPP::Redirector(sink));<br><br>=C2=A0 =C2=A0 source.=
Attach(new CryptoPP::Redirector(filter));<br>=C2=A0 =C2=A0 filter.Attach(ne=
w CryptoPP::Redirector(sink));<br><br>=C2=A0 =C2=A0 while (!EndOfFile(sourc=
e) &amp;&amp; !source.SourceExhausted())<br>=C2=A0 =C2=A0 {<br>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 source.Pump(TransferBytes);<br>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 filter.Flush(false);<br>=C2=A0 =C2=A0 }<br>=C2=A0 =C2=A0 filter.Message=
End();</span></div></blockquote><div><br></div><div>GCM plaintext maximum l=
ength is specified in bits, not bytes. See SP800-39D, Section 5.2.1.1 Input=
 Data, p. 8, &lt;<a href=3D"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nis=
tspecialpublication800-38d.pdf">https://nvlpubs.nist.gov/nistpubs/Legacy/SP=
/nistspecialpublication800-38d.pdf</a>&gt;. That leads to:</div><div><br></=
div><div>=C2=A0 =C2=A0 2^39 - 256 =3D=C2=A0<span class=3D"gmail-qv3Wpe" id=
=3D"gmail-cwos">549755813632</span></div><div><span class=3D"gmail-qv3Wpe" =
id=3D"gmail-cwos">=C2=A0 =C2=A0 549755813632 / 8 =3D=C2=A0</span><span clas=
s=3D"gmail-qv3Wpe" id=3D"gmail-cwos">68719476704</span></div><div><span cla=
ss=3D"gmail-qv3Wpe" id=3D"gmail-cwos"><br></span></div><div><span class=3D"=
gmail-qv3Wpe" id=3D"gmail-cwos">The limit is declared in gcm.h, &lt;</span>=
<a href=3D"https://github.com/weidai11/cryptopp/blob/master/gcm.h#L61">http=
s://github.com/weidai11/cryptopp/blob/master/gcm.h#L61</a><span class=3D"gm=
ail-qv3Wpe" id=3D"gmail-cwos">&gt;. The maximum plaintext limit is enforced=
 in authenc.cpp, &lt;</span><a href=3D"https://github.com/weidai11/cryptopp=
/blob/master/authenc.cpp#L109">https://github.com/weidai11/cryptopp/blob/ma=
ster/authenc.cpp#L109</a><span class=3D"gmail-qv3Wpe" id=3D"gmail-cwos">&gt=
;.</span></div><div><span class=3D"gmail-qv3Wpe" id=3D"gmail-cwos"><br></sp=
an></div><div><span class=3D"gmail-qv3Wpe" id=3D"gmail-cwos">Jeff</span></d=
iv></div></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Crypto++ Users&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">cryp=
[email protected]</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
cryptopp-users/CAH8yC8kdtNcJGPmkDBfOSLPAMn6RyNG0uEOEfpYPGgciMWqtww%40mail.g=
mail.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/=
d/msgid/cryptopp-users/CAH8yC8kdtNcJGPmkDBfOSLPAMn6RyNG0uEOEfpYPGgciMWqtww%=
40mail.gmail.com</a>.<br />

--00000000000014e680063c29eb6d--