Re: cgd(4) ciphers

["Roland C. Dowdeswell" <elric%imrryr.org@localhost>]

On Mon, Sep 30, 2013 at 07:22:21AM +0000, Taylor R Campbell wrote:
>

> (c) has 256-bit blocks, so we don't need to worry about birthday
> bounds for 128-bit block ciphers on multi-terabyte disks; and

IIRC, the probability of collisions with k values of N is approximated
by k^2/2N.  So, for, say a one terabyte disk and a 128 bit block size
we would get:

        k = 2^40 (bytes) / 16 == 2^36 (ciphertext blocks)
        N = 2^128

        k^2 = 2^72
        2N  = 2^129

        k^2/2N = 2^-57

Those are not bad odds.  For a petabyte disk, however, it could start
to be a concern:

        (2^46)^2/2^129 == 2^-37

--
    Roland Dowdeswell                      http://Imrryr.ORG/~elric/