# Ciphertext expansion
> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/Ciphertext_expansion
> Markdown URL: https://mediated.wiki/source/Ciphertext_expansion.md
> Source: https://en.wikipedia.org/wiki/Ciphertext_expansion
> Source revision: 1320718511
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)
{{Short description|Length increase of a message when it is encrypted}}
In [cryptography](/source/cryptography), the term '''ciphertext expansion'''[{{Cite book |last=Jain |first=V.K. |title=Cryptography and Network Security |publisher=Khanna Book Publishing Co. |isbn=9789380016801 |pages=108}}] refers to the length increase of a message when it is [encrypted](/source/encryption). Many modern cryptosystems cause some degree of expansion during the encryption process, for instance when the resulting [ciphertext](/source/ciphertext) must include a message-unique [Initialization Vector](/source/Initialization_Vector) (IV). [Probabilistic encryption](/source/Probabilistic_encryption) schemes cause ciphertext expansion, as the set of possible ciphertexts is necessarily greater than the set of input plaintexts. Certain schemes, such as [Cocks Identity Based Encryption](/source/Cocks_Identity_Based_Encryption), or the [Goldwasser-Micali cryptosystem](/source/Goldwasser-Micali_cryptosystem) result in ciphertexts hundreds or thousands of times longer than the plaintext.
Ciphertext expansion may be offset or increased by other processes which compress or expand the message, e.g., [data compression](/source/data_compression) or [error correction coding](/source/error_correction_codes).
== Reasons why Ciphertext expansion can occur ==
=== Probabilistic Encryption ===
Probabilistic encryption schemes, such as the [Goldwasser-Micali cryptosystem](/source/Goldwasser%E2%80%93Micali_cryptosystem), necessarily produce ciphertexts that are longer than the original plaintexts. This is because the set of possible [ciphertexts](/source/ciphertexts) must be larger than the set of plaintexts to achieve semantic security.[{{Cite web |title=How to solve the problem of FHE ciphertext expansion? |url=https://crypto.stackexchange.com/questions/103963/how-to-solve-the-problem-of-fhe-ciphertext-expansion |access-date=2024-07-17 |website=Cryptography Stack Exchange |language=en}}]
=== Initialization Vectors (IVs) ===
Many block cipher modes of operation, like [Cipher Block Chaining](/source/Block_cipher_mode_of_operation) (CBC), require the use of an Initialization Vector (IV) that is unique for each message. The IV is typically appended to the ciphertext, resulting in expansion.[{{Cite web |title=Ciphertext expansion {{!}} Semantic Scholar |url=https://www.semanticscholar.org/topic/Ciphertext-expansion/506973 |access-date=2024-07-17 |website=www.semanticscholar.org |language=en}}]
=== Redundancy and Error Correction ===
Some cryptographic schemes intentionally introduce redundancy or error correction codes into the [ciphertext](/source/Ciphertext_stealing) to protect against [tampering](/source/Tampering_(crime)) or transmission errors. This added data increases the ciphertext size.{{Citation needed|date=November 2025}}
=== Specific Cryptosystems ===
Certain cryptographic schemes, such as [Cocks Identity-Based Encryption](/source/Cocks_Identity_Based_Encryption), can produce ciphertexts that are hundreds or thousands of times longer than the original plaintext. This extreme expansion is a design choice to achieve the desired security properties.