Predicting the length of an encrypted string

Question

I am using this for encryption: http://msdn.microsoft.com/en-us/library/system.security.cryptography.rijndaelmanaged.aspx

Is there a way I can predict what the encrypted text will look like? I am converting the encrypted output to text so I can store it in the db.

I just want to make sure the size of the database column is large enough.

I am limiting the text input to be 20 characters.

Answer 1

Are you using SQL Server 2005 or above? If so you could just use VARCHAR(MAX) or NVARCHAR(MAX) for the column type.

If you want to be a bit more precise...

The maximum block size for RijndaelManaged is 256 bits (32 bytes).

Your maximum input size is 20 characters, so even if we assume a worst-case scenario of 4 bytes per character, that'll only amount to 80 bytes, which will then be padded up to a maximum of 96 bytes for the encryption process.

If you use Base64 encoding on the encrypted output that will create 128 characters from the 96 encrypted bytes. If you use hex encoding then that will create 192 characters from the 96 encrypted bytes (plus maybe a couple of extra characters if you're prefixing the hex string with "0x"). In either case a column width of 200 characters should give you more than enough headroom.

(NB: These are just off-the-top-of-my-head calculations. I haven't verified that they're actually correct!)

Answer 2

For an unknown encryption algorithm with no information to be found online, I would write a little test program that encrypted a random set of strings of maximum length, find the longest length in the output, then multiply by a safety factor based on how likely the length of input is to change, and how accurate the result of the test program was.

Really generally speaking though, you're probably going to be in the 1.5x - 2x input length range.

Answer 3

If you look at the "Test vectors" section in the Wikipedia page on Rijndael, you can see typical output size (dependent on block size) for a specific input.

Answer 4

Encryption will never increase the size of data beyond the minimum padding required.

If it does 'expand' the data, it is probably not a very good encryption algorithm.

Answer 5

For this specific algorithm, the length of ciphertext will be,

   ((length+16)/16)*16

This is to meet the block size and padding requirement.

I suggest you also add an random IV to the ciphertext so that will take another 16 bytes.

However, if you want put this as char in database, you have to encode it. That will increase it even more.

For base64, multiply it by 4/3. For hex, double it.