English
Menu

Applied Cryptography

Let 1 GiB = 2³⁰ bytes and 1 EiB = 2⁶⁰ bytes. A block cipher with a 64-bit block (such as 3DES) is used in CBC mode to encrypt a large amount of data under one key. Treating the ciphertext blocks as random 64-bit values, which of the following is the approximate amount of data at which, by the birthday paradox, the probability that a pair of identical ciphertext blocks appears can no longer be ignored?

  1. AAbout 4 GiB
  2. BAbout 32 GiB
  3. CAbout 128 EiB
Show answer and explanation

Answer: B. About 32 GiB

A 64-bit block can take 2⁶⁴ values, so by the birthday paradox the probability that a pair of equal values appears can no longer be ignored after encrypting about 2^(64/2) = 2³² blocks (about 39% at 2³² blocks). One block is 8 bytes, so the amount of data is 2³² × 8 = 2³⁵ bytes = 32 GiB. In CBC mode, when two ciphertext blocks match, the XOR of the two corresponding plaintext blocks is revealed, and the Sweet32 attack published in 2016 showed that cookies could be extracted from long HTTPS sessions protected with 3DES. For AES with its 128-bit block, the threshold extends to 2⁶⁴ blocks.

  • A. About 4 GiB is 2³² bytes, the value obtained without multiplying by the 8 bytes per block.
  • B. Correct. 2³² blocks × 8 bytes = 32 GiB.
  • C. About 128 EiB is 2⁶⁴ blocks × 8 bytes = 2⁶⁷ bytes, the value obtained by taking the number needed for a collision as 2ⁿ instead of 2^(n/2).
Practice this topic Back to topic

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

More Applied Cryptography questions

  1. In protocols such as TLS 1.3, the shared secret obtained from an ECDHE key exchange is not used directly as an encryption key; instead keys are made by passing it through a key derivation function (KDF) such as HKDF. Which of the following is an appropriate reason?
  2. The mechanism of RSA is checked with small numbers. From the primes p = 5 and q = 11, n = pq is formed, and the public exponent is e = 3. With φ(n) = (p − 1)(q − 1), which of the following is the private exponent d (0 < d < φ(n)) that satisfies e × d ≡ 1 (mod φ(n))?
  3. In RSA, let the public key be n = 55 and e = 3. Which of the following is the ciphertext c when the plaintext m = 7 is encrypted as c = m^e mod n?
  4. Which of the following correctly describes a problem with using textbook RSA (computing c = m^e mod n directly from the plaintext m) without padding in real communication?
  5. In Diffie–Hellman key exchange, a prime p and a generator g are public; A and B choose secret values a and b and send each other g^a mod p and g^b mod p. Which of the following is the reason an eavesdropper is believed unable to find the shared secret g^(ab) mod p even after seeing all these public values?

Comparisons in this topic