Re: aes/gcm maximum plaintext size; handling of large files
Uri Blumenthal <[email protected]> Wed, 13 Aug 2025 06:54:39 -0400
| Newsgroups | gmane.comp.encryption.cryptopp |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail-D42478E7-3493-4BF1-BDC6-E7A15924EB4A Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Filesystems (if memory servers me) use AES in XTS mode.=20 > On Aug 13, 2025, at 06:46, Jeffrey Walton <[email protected]> wrote: >=20 > =EF=BB=BF >=20 >=20 >> On Tue, Aug 12, 2025 at 5:07=E2=80=AFPM Lana Deere <[email protected]= > wrote: >> On Tuesday, August 12, 2025 at 8:10:03=E2=80=AFAM UTC-4 Jeffrey Walton w= rote: >> GCM plaintext maximum length is specified in bits, not bytes. See SP800-= 39D, Section 5.2.1.1 Input Data, p. 8, <https://nvlpubs.nist.gov/nistpubs/L= egacy/SP/nistspecialpublication800-38d.pdf>. That leads to: >>=20 >> 2^39 - 256 =3D 549755813632 >> 549755813632 / 8 =3D 68719476704 >>=20 >> Is there a standard practice for handling AES encryption of large files?= E.g., create a new IV and resume encryption? Use something other than GC= M which has a higher limit? >=20 > The limit you are encountering in GCM mode is due to an internal 32-bit c= ounter. The limit is not directly due to AES. >=20 > You could use a block cipher and mode of operation with a 64-bit counter,= or a stream cipher with a 64-bit counter. Bernstein's original ChaCha20 ha= s an internal 64-bit counter. So Bernstein's ChaCha20 paired with Poly1305 = could be a good replacement for you. See <https://www.cryptopp.com/wiki/Cha= Cha20>. >=20 > The IETF's version of ChaCha20 used in TLS regresses to a 32-bit counter,= so don't use it. >=20 > Jeff > --=20 > You received this message because you are subscribed to the Google Groups= "Crypto++ Users" group. > To unsubscribe from this group and stop receiving emails from it, send an= email to [email protected]. > To view this discussion visit https://groups.google.com/d/msgid/cryptopp-= users/CAH8yC8%3DaTnOxAvMWbOOFto2RnUtqPecxTW_k-%3DmBNaXLt8Mq1A%40mail.gmail.= com. --=20 You received this message because you are subscribed to the Google Groups "= Crypto++ Users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/cryptopp-us= ers/E471EEC0-A232-4D08-B494-948575F8F2F5%40gmail.com. --Apple-Mail-D42478E7-3493-4BF1-BDC6-E7A15924EB4A Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <html><head><meta http-equiv=3D"content-type" content=3D"text/html; charset= =3Dutf-8"></head><body dir=3D"auto">Filesystems (if memory servers me) use = AES in XTS mode. <br><div dir=3D"ltr"><br><blockquote type=3D"cite">On= Aug 13, 2025, at 06:46, Jeffrey Walton <[email protected]> wrote:<b= r><br></blockquote></div><blockquote type=3D"cite"><div dir=3D"ltr">=EF=BB= =BF<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quot= e gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Aug = 12, 2025 at 5:07=E2=80=AFPM Lana Deere <<a href=3D"mailto:lana.deere@gma= il.com">[email protected]</a>> wrote:<br></div><blockquote class=3D"g= mail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204= ,204,204);padding-left:1ex"><div><div dir=3D"auto">On Tuesday, August 12, 2= 025 at 8:10:03=E2=80=AFAM UTC-4 Jeffrey Walton wrote:<br></div><blockquote = style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);pa= dding-left:1ex"><div dir=3D"ltr"><div><div>GCM plaintext maximum length is = specified in bits, not bytes. See SP800-39D, Section 5.2.1.1 Input Data, p.= 8, <<a href=3D"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialp= ublication800-38d.pdf" rel=3D"nofollow" target=3D"_blank">https://nvlpubs.n= ist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf</a>>. That = leads to:</div><div><br></div><div> 2^39 - 256 =3D <span>= 549755813632</span></div><div><span> 549755813632 / 8 =3D = ;</span><span>68719476704</span></div></div></div></blockquote><div><br></d= iv><div>Is there a standard practice for handling AES encryption of large f= iles? E.g., create a new IV and resume encryption? Use somethin= g other than GCM which has a higher limit?</div></div></blockquote><div><br= ></div><div>The limit you are encountering in GCM mode is due to an interna= l 32-bit counter. The limit is not directly due to AES.</div><div><br></div= ><div>You could use a block cipher and mode of operation with a 64-bit coun= ter, or a stream cipher with a 64-bit counter. Bernstein's original ChaCha2= 0 has an internal 64-bit counter. So Bernstein's ChaCha20 paired with Poly1= 305 could be a good replacement for you. See <<a href=3D"https://www.cry= ptopp.com/wiki/ChaCha20">https://www.cryptopp.com/wiki/ChaCha20</a>>.</d= iv><div><br></div><div>The IETF's version of ChaCha20 used in TLS regresses= to a 32-bit counter, so don't use it.</div><div><br></div><div>Jeff</div><= /div></div> <p></p> -- <br> You received this message because you are subscribed to the Google Groups "= Crypto++ Users" group.<br> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:[email protected]">cryp= [email protected]</a>.<br> To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/= cryptopp-users/CAH8yC8%3DaTnOxAvMWbOOFto2RnUtqPecxTW_k-%3DmBNaXLt8Mq1A%40ma= il.gmail.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.goo= gle.com/d/msgid/cryptopp-users/CAH8yC8%3DaTnOxAvMWbOOFto2RnUtqPecxTW_k-%3Dm= BNaXLt8Mq1A%40mail.gmail.com</a>.<br> </div></blockquote></body></html> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;Crypto++ Users" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:[email protected]">cryp= [email protected]</a>.<br /> To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/= cryptopp-users/E471EEC0-A232-4D08-B494-948575F8F2F5%40gmail.com?utm_medium= =3Demail&utm_source=3Dfooter">https://groups.google.com/d/msgid/cryptopp-us= ers/E471EEC0-A232-4D08-B494-948575F8F2F5%40gmail.com</a>.<br /> --Apple-Mail-D42478E7-3493-4BF1-BDC6-E7A15924EB4A--