Sweet32

cryptography

A 2016 attack exploiting birthday bounds on 64-bit block ciphers like 3DES.

Sweet32 showed that ciphers with a 64-bit block, such as 3DES and Blowfish, leak data once enough traffic is encrypted under one key, due to block collisions. It drove deprecation of 3DES in TLS.

Sweet32 exploits a property of 64-bit block ciphers rather than a flaw in their implementation. With a small block size, the birthday bound arrives at a practical volume of data: after roughly 32 gigabytes on one key, two ciphertext blocks are likely to collide, and a collision leaks information about the plaintext.

What made it real rather than theoretical was long-lived connections. A persistent HTTPS or VPN session carrying enough traffic reaches that volume, and a browser can be induced to generate it. 3DES and Blowfish were the affected ciphers, both still enabled for compatibility long after better options existed.

The response was to retire 64-bit block ciphers rather than to rekey more often, which is the correct engineering choice: a mitigation that depends on nobody exceeding a data limit fails whenever somebody does. It is also a good illustration that cryptographic parameters have expiry conditions built into the mathematics. Block size, key size and nonce size all imply a volume of use beyond which the guarantee stops holding, and those limits arrive sooner as networks get faster.

Also known as: Sweet32, CVE-2016-2183

← All glossary entries