Re: aes/gcm maximum plaintext size; handling of large files

Uri Blumenthal <[email protected]> Wed, 13 Aug 2025 06:54:39 -0400
Newsgroups gmane.comp.encryption.cryptopp
Message-ID <[email protected]>
--Apple-Mail-D42478E7-3493-4BF1-BDC6-E7A15924EB4A
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Filesystems (if memory servers me) use AES in XTS mode.=20

> On Aug 13, 2025, at 06:46, Jeffrey Walton <[email protected]> wrote:
>=20
> =EF=BB=BF
>=20
>=20
>> On Tue, Aug 12, 2025 at 5:07=E2=80=AFPM Lana Deere <[email protected]=
> wrote:
>> On Tuesday, August 12, 2025 at 8:10:03=E2=80=AFAM UTC-4 Jeffrey Walton w=
rote:
>> GCM plaintext maximum length is specified in bits, not bytes. See SP800-=
39D, Section 5.2.1.1 Input Data, p. 8, <https://nvlpubs.nist.gov/nistpubs/L=
egacy/SP/nistspecialpublication800-38d.pdf>. That leads to:
>>=20
>>     2^39 - 256 =3D 549755813632
>>     549755813632 / 8 =3D 68719476704
>>=20
>> Is there a standard practice for handling AES encryption of large files?=
  E.g., create a new IV and resume encryption?  Use something other than GC=
M which has a higher limit?
>=20
> The limit you are encountering in GCM mode is due to an internal 32-bit c=
ounter. The limit is not directly due to AES.
>=20
> You could use a block cipher and mode of operation with a 64-bit counter,=
 or a stream cipher with a 64-bit counter. Bernstein's original ChaCha20 ha=
s an internal 64-bit counter. So Bernstein's ChaCha20 paired with Poly1305 =
could be a good replacement for you. See <https://www.cryptopp.com/wiki/Cha=
Cha20>.
>=20
> The IETF's version of ChaCha20 used in TLS regresses to a 32-bit counter,=
 so don't use it.
>=20
> Jeff
> --=20
> You received this message because you are subscribed to the Google Groups=
 "Crypto++ Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an=
 email to [email protected].
> To view this discussion visit https://groups.google.com/d/msgid/cryptopp-=
users/CAH8yC8%3DaTnOxAvMWbOOFto2RnUtqPecxTW_k-%3DmBNaXLt8Mq1A%40mail.gmail.=
com.

--=20
You received this message because you are subscribed to the Google Groups "=
Crypto++ Users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/cryptopp-us=
ers/E471EEC0-A232-4D08-B494-948575F8F2F5%40gmail.com.

--Apple-Mail-D42478E7-3493-4BF1-BDC6-E7A15924EB4A
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<html><head><meta http-equiv=3D"content-type" content=3D"text/html; charset=
=3Dutf-8"></head><body dir=3D"auto">Filesystems (if memory servers me) use =
AES in XTS mode.&nbsp;<br><div dir=3D"ltr"><br><blockquote type=3D"cite">On=
 Aug 13, 2025, at 06:46, Jeffrey Walton &lt;[email protected]&gt; wrote:<b=
r><br></blockquote></div><blockquote type=3D"cite"><div dir=3D"ltr">=EF=BB=
=BF<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quot=
e gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Aug =
12, 2025 at 5:07=E2=80=AFPM Lana Deere &lt;<a href=3D"mailto:lana.deere@gma=
il.com">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"g=
mail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204=
,204,204);padding-left:1ex"><div><div dir=3D"auto">On Tuesday, August 12, 2=
025 at 8:10:03=E2=80=AFAM UTC-4 Jeffrey Walton wrote:<br></div><blockquote =
style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);pa=
dding-left:1ex"><div dir=3D"ltr"><div><div>GCM plaintext maximum length is =
specified in bits, not bytes. See SP800-39D, Section 5.2.1.1 Input Data, p.=
 8, &lt;<a href=3D"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialp=
ublication800-38d.pdf" rel=3D"nofollow" target=3D"_blank">https://nvlpubs.n=
ist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf</a>&gt;. That =
leads to:</div><div><br></div><div>&nbsp; &nbsp; 2^39 - 256 =3D&nbsp;<span>=
549755813632</span></div><div><span>&nbsp; &nbsp; 549755813632 / 8 =3D&nbsp=
;</span><span>68719476704</span></div></div></div></blockquote><div><br></d=
iv><div>Is there a standard practice for handling AES encryption of large f=
iles?&nbsp; E.g., create a new IV and resume encryption?&nbsp; Use somethin=
g other than GCM which has a higher limit?</div></div></blockquote><div><br=
></div><div>The limit you are encountering in GCM mode is due to an interna=
l 32-bit counter. The limit is not directly due to AES.</div><div><br></div=
><div>You could use a block cipher and mode of operation with a 64-bit coun=
ter, or a stream cipher with a 64-bit counter. Bernstein's original ChaCha2=
0 has an internal 64-bit counter. So Bernstein's ChaCha20 paired with Poly1=
305 could be a good replacement for you. See &lt;<a href=3D"https://www.cry=
ptopp.com/wiki/ChaCha20">https://www.cryptopp.com/wiki/ChaCha20</a>&gt;.</d=
iv><div><br></div><div>The IETF's version of ChaCha20 used in TLS regresses=
 to a 32-bit counter, so don't use it.</div><div><br></div><div>Jeff</div><=
/div></div>

<p></p>

-- <br>
You received this message because you are subscribed to the Google Groups "=
Crypto++ Users" group.<br>
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">cryp=
[email protected]</a>.<br>
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
cryptopp-users/CAH8yC8%3DaTnOxAvMWbOOFto2RnUtqPecxTW_k-%3DmBNaXLt8Mq1A%40ma=
il.gmail.com?utm_medium=3Demail&amp;utm_source=3Dfooter">https://groups.goo=
gle.com/d/msgid/cryptopp-users/CAH8yC8%3DaTnOxAvMWbOOFto2RnUtqPecxTW_k-%3Dm=
BNaXLt8Mq1A%40mail.gmail.com</a>.<br>
</div></blockquote></body></html>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Crypto++ Users&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">cryp=
[email protected]</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
cryptopp-users/E471EEC0-A232-4D08-B494-948575F8F2F5%40gmail.com?utm_medium=
=3Demail&utm_source=3Dfooter">https://groups.google.com/d/msgid/cryptopp-us=
ers/E471EEC0-A232-4D08-B494-948575F8F2F5%40gmail.com</a>.<br />

--Apple-Mail-D42478E7-3493-4BF1-BDC6-E7A15924EB4A--