Let's assume that there are two nodes A and B connected over a network. Both have a single pre-shared symmetric key (e.g., AES-128) and exchange messages.

What is the recommended period, until the key should not be used anymore? Can they go on forever?

Is there a maximum number of messages after which a rekeying should occur?

Is there a difference between the different attack models like ciphertext-only and chosen-plaintext?



1 Answer 1


Exact answer depends on the involved mode of operation, but most of them begin to exhibit unwanted structure when about 2n/2 blocks have been processed, when the underlying block cipher uses n-bit blocks. The fundamental reason for this is that a block cipher like AES is a permutation: any two distinct input blocks are encrypted into two distinct output blocks, always; whereas a pseudorandom function may send two inputs to the same output value, and this ought to become apparent when 2n/2 or so input values have been processed. This is a variant on the so-called birthday paradox.

When that limit is reached, consequences again depend on the involved mode, but they should not be ignored.

In the case of AES, n = 128 (AES uses 128-bit blocks), so you are good for 264 blocks of 16 bytes, which is about 300 millions of terabytes -- in practice, "forever". That's the exact reason AES was defined to use 128-bit blocks, whereas most block ciphers of that era (3DES, RC2, RC5, Blowfish, IDEA...) used 64-bit blocks: so that the 2n/2 limit is pushed sufficiently high to cease to be inconvenient.

There is Tradition, though. For a long time, cryptography was used without computers, relying on algorithms which were quite weak and prone to reveal secrets through statistical analysis. Moreover, cryptography was an exclusively military and diplomatic tool, in a context where it had to be assumed that a substantial proportion of field agent were, at any time, working for the enemy. Both characteristics called for frequent key renewal, to overcome leakage through poor algorithms, and to contain the damage arising from corrupt insiders. In most modern situations, things don't go that way: we have good algorithms which don't leak, and under normal conditions there is no attacker within your systems (and when there is, you have already lost and key renewal won't help). However, you will encounter a lot of standards and guides and "best practices" which mandate renewal after having encrypted some arbitrary amount, usually in the gigabytes range -- the amount is rarely justified, and the whole concept is a remnant of a troubled past.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .