Re: aes/gcm maximum plaintext size; handling of large files
Jeffrey Walton <[email protected]> Wed, 13 Aug 2025 13:38:51 -0400
| Newsgroups | gmane.comp.encryption.cryptopp |
|---|---|
| Message-ID | <CAH8yC8mS7jyjEX=4iwqtxVbdbZLXHSga9=_FLzBZ3q7CqpAo-w@mail.gmail.com> |
--0000000000007ea18f063c42a3d5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Aug 13, 2025 at 12:24=E2=80=AFPM Lana Deere <[email protected]> = wrote: > I will look into ChaCha20. Thank-you everyone who offered suggestions. > AES/CTR might also work for you. It looks like Crypto++ uses the entire initial value as both a nonce and a counter [1,2]. Once you set the initial value with a nonce, the library increments the entire 16-byte block. So you basically have a 128-bit counter. [1] <https://github.com/weidai11/cryptopp/blob/master/modes.cpp#L137> [2] <https://github.com/weidai11/cryptopp/blob/master/modes.cpp#L169> Jeff > On Wed, Aug 13, 2025 at 6:46=E2=80=AFAM Jeffrey Walton <[email protected]= m> wrote: > >> >> >> On Tue, Aug 12, 2025 at 5:07=E2=80=AFPM Lana Deere <[email protected]= > wrote: >> >>> On Tuesday, August 12, 2025 at 8:10:03=E2=80=AFAM UTC-4 Jeffrey Walton = wrote: >>> >>> GCM plaintext maximum length is specified in bits, not bytes. See >>> SP800-39D, Section 5.2.1.1 Input Data, p. 8, < >>> https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-3= 8d.pdf>. >>> That leads to: >>> >>> 2^39 - 256 =3D 549755813632 >>> 549755813632 / 8 =3D 68719476704 >>> >>> >>> Is there a standard practice for handling AES encryption of large >>> files? E.g., create a new IV and resume encryption? Use something oth= er >>> than GCM which has a higher limit? >>> >> >> The limit you are encountering in GCM mode is due to an internal 32-bit >> counter. The limit is not directly due to AES. >> >> You could use a block cipher and mode of operation with a 64-bit counter= , >> or a stream cipher with a 64-bit counter. Bernstein's original ChaCha20 = has >> an internal 64-bit counter. So Bernstein's ChaCha20 paired with Poly1305 >> could be a good replacement for you. See < >> https://www.cryptopp.com/wiki/ChaCha20>. >> >> The IETF's version of ChaCha20 used in TLS regresses to a 32-bit counter= , >> so don't use it. >> > --=20 You received this message because you are subscribed to the Google Groups "= Crypto++ Users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/cryptopp-us= ers/CAH8yC8mS7jyjEX%3D4iwqtxVbdbZLXHSga9%3D_FLzBZ3q7CqpAo-w%40mail.gmail.co= m. --0000000000007ea18f063c42a3d5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote g= mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, Aug 13,= 2025 at 12:24=E2=80=AFPM Lana Deere <<a href=3D"mailto:lana.deere@gmail= .com">[email protected]</a>> wrote:<br></div><blockquote class=3D"gma= il_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,2= 04,204);padding-left:1ex"><div dir=3D"ltr"><div>I will look into ChaCha20.= =C2=A0 Thank-you everyone who offered suggestions.</div></div></blockquote>= <div><br></div><div>AES/CTR might also work for you. It looks like Crypto++= uses the entire initial value as both a nonce and a counter [1,2]. Once yo= u set the initial value with a nonce, the library increments the entire 16-= byte block. So you basically have a 128-bit counter.</div><div><br></div><d= iv>[1] <<a href=3D"https://github.com/weidai11/cryptopp/blob/master/mode= s.cpp#L137">https://github.com/weidai11/cryptopp/blob/master/modes.cpp#L137= </a>></div><div>[2] <<a href=3D"https://github.com/weidai11/cryptopp/= blob/master/modes.cpp#L169">https://github.com/weidai11/cryptopp/blob/maste= r/modes.cpp#L169</a>></div><div><br></div><div>Jeff</div><div>=C2=A0</di= v><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;borde= r-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=3D"gmail_quo= te"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, Aug 13, 2025 at 6:46=E2= =80=AFAM Jeffrey Walton <<a href=3D"mailto:[email protected]" target=3D= "_blank">[email protected]</a>> wrote:<br></div><blockquote class=3D"gm= ail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,= 204,204);padding-left:1ex"><div dir=3D"ltr"><div dir=3D"ltr"><br></div><br>= <div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Au= g 12, 2025 at 5:07=E2=80=AFPM Lana Deere <<a href=3D"mailto:lana.deere@g= mail.com" target=3D"_blank">[email protected]</a>> wrote:<br></div><b= lockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-le= ft:1px solid rgb(204,204,204);padding-left:1ex"><div><div dir=3D"auto">On T= uesday, August 12, 2025 at 8:10:03=E2=80=AFAM UTC-4 Jeffrey Walton wrote:<b= r></div><blockquote style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid= rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div><div>GCM plaintex= t maximum length is specified in bits, not bytes. See SP800-39D, Section 5.= 2.1.1 Input Data, p. 8, <<a href=3D"https://nvlpubs.nist.gov/nistpubs/Le= gacy/SP/nistspecialpublication800-38d.pdf" rel=3D"nofollow" target=3D"_blan= k">https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38= d.pdf</a>>. That leads to:</div><div><br></div><div>=C2=A0 =C2=A0 2^39 -= 256 =3D=C2=A0<span>549755813632</span></div><div><span>=C2=A0 =C2=A0 54975= 5813632 / 8 =3D=C2=A0</span><span>68719476704</span></div></div></div></blo= ckquote><div><br></div><div>Is there a standard practice for handling AES e= ncryption of large files?=C2=A0 E.g., create a new IV and resume encryption= ?=C2=A0 Use something other than GCM which has a higher limit?</div></div><= /blockquote><div><br></div><div>The limit you are encountering in GCM mode = is due to an internal 32-bit counter. The limit is not directly due to AES.= </div><div><br></div><div>You could use a block cipher and mode of operatio= n with a 64-bit counter, or a stream cipher with a 64-bit counter. Bernstei= n's original ChaCha20 has an internal 64-bit counter. So Bernstein'= s ChaCha20 paired with Poly1305 could be a good replacement for you. See &l= t;<a href=3D"https://www.cryptopp.com/wiki/ChaCha20" target=3D"_blank">http= s://www.cryptopp.com/wiki/ChaCha20</a>>.</div><div><br></div><div>The IE= TF's version of ChaCha20 used in TLS regresses to a 32-bit counter, so = don't use it.</div></div></div></blockquote></div></blockquote></div></= div> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;Crypto++ Users" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:[email protected]">cryp= [email protected]</a>.<br /> To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/= cryptopp-users/CAH8yC8mS7jyjEX%3D4iwqtxVbdbZLXHSga9%3D_FLzBZ3q7CqpAo-w%40ma= il.gmail.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.= com/d/msgid/cryptopp-users/CAH8yC8mS7jyjEX%3D4iwqtxVbdbZLXHSga9%3D_FLzBZ3q7= CqpAo-w%40mail.gmail.com</a>.<br /> --0000000000007ea18f063c42a3d5--