In my Java application, I used AES/GCM/NoPadding algorithm for encryption, however it throws an exception when I try to encrypt files bigger than ~68GB. From what I read, it is limit of data that can be encrypted using GCM.

I know that there is a possibility to split bigger files and then merge them, but this seems like a complicated solution. Is there an algorithm that is as safe as GCM, but handles massive files?

I tested CBC, and this works with bigger files, however I read that it is ~40yo, and not as safe, due to lack of authorization. Does it really cause safety problems? Are there any alternatives?

Edit: Thank you all. As a result of Sonar marking CBC as unsafe and orders from senior architect, I implemented file split/merge with GCM in application.

  • 1
    this might be helpful : crypto.stackexchange.com/questions/35520/… – hardyrama Mar 30 '19 at 11:46
  • I wonder how do you generate encryption keys for the individual split blocks. An "encrypt then MAC" construct can add integrity protection to any mode including CBC, but it has a disadvantage of iterating over the data twice, while AES-GCM does it in a single pass. – user185953 Apr 24 '19 at 15:48
  • I'm using the same key for all parts of file. – Michal Ruszkowski May 7 '19 at 9:13

GCM mode combines CTR (counter) mode with MAC called GHASH. You can use virtually any standard block mode if you combine a MAC with it. For example, you can use AES in CBC or CTR mode if you also use HMAC, a MAC that uses cryptographic hashes for authentication. It is always better to encrypt first and then apply the HMAC over the ciphertext, a construction called Encrypt-then-MAC (EtM).

  • 2
    Please see – kelalaka Mar 30 '19 at 20:15
  • The other comment by @kelalaka nicely explains the AES-GCM limit, but it is almost invisible because the size of it and it is too easy to miss the included link – user185953 Apr 24 '19 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.