3DES and birthday attacks

[vouillon]

3DES is subject to birthday attacks: with over 32 gigabytes of data, there is about 50% chance that two 64-bit blocks have been similarly encoded; then, some information could be recovered by xoring them.

A workaround is to force a rekeying (renegotiation) much sooner. However, this adds some complexity to the implementation and it might be hard to check that this has been correctly implemented (and that it remains so over time).

As far as I know, other ciphers are not subject to this attack. In particular, AES uses 128-bit blocks, which makes the attack impossible.

References:

• rfc 4772 (section A.3)
• http://en.wikipedia.org/wiki/Block_size_%28cryptography%29
• Against rekeying

[hannesm]

since the 0.9.0 release, 3DES is disabled by default, unclear when/how to remove the 3DES code entirely.

the library-initiated renegotiation after n bytes is at the moment out of scope.