Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a system that signs plain text messages using a message authentication code (MAC) encrypted with 3-key Triple DES. The short message is used on connection to establish a session key, so it would take an attacker a long time to compile a lot of plaintext / MAC examples.

I need to establish a key expiration policy that says "keys shall be changed at interval X" to maintain security. What is a reasonable time limit considering only the cryptographic threats?

  1. From the reading that I have done, I expect that a brute-force attack (Lucks attack, ref. rfc4772, effective 108 bits) is not practical within the lifetime of the system (30 years) and is not a threat that requires periodic changing of keys. Is this true?

  2. There seem to be some attacks that benefit from compiling a lot of plaintext / ciphertext examples. A reasonable key policy would be to change the key before enough examples could be collected. What is a reasonable limit, considering the known attacks on Triple DES? Something I read (edit: suggested 2^32 blocks was such a limit.

share|improve this question
1) Which MAC construction are you use? 2) Why choose 3DES over HMAC or even AES? 3) Attacks become likely as you approach 2^32 blocks, you should stay significantly below that value. – CodesInChaos Mar 6 '14 at 17:18
1) It is a type of CBC-MAC, but I'm not familiar enough with the literature to know how "standard" or special it is. If you care to read about it, google "Subset-037". Used in train signalling. 2) Good comment, but this is a "legacy" system that I cannot change. 3) The CBC-MAC digests the message in CBC mode and cooks it down to a single block of ciphertext. I assume that this only counts as one block (for purposes of key wear) even if the message is longer. Is that correct? – John Price Mar 11 '14 at 20:10
I would do "prior to $2^{31}$ blocks of plaintext" between key changes, for the purposes of attacks it is NOT just the last block, but the total encrypted blocks. – Richie Frame Mar 12 '14 at 6:35
I hope you mean "I have a legacy system with Triple DES" rather than "I am building a system with Triple DES", unless you are being compelled. Incidentally, I believe it has 80 bits of security, from known/chosen plaintext attacks. – Nathan Cooper Mar 12 '14 at 11:36
@Richie, thanks for your input - 2^31 seems like an appropriate limit also considering the comment from CodesInChaos. One clarification though - the message itself is sent in plain text with only a 64-bit (one block) MAC for authentication. In this way, the message is not "encrypted" but "authenticated" with a single block MAC. However, the entire message (about 5 blocks) is the input to the MAC algorithm. In this way, the MAC is only a single block of "encrypted" text. Would you still interpret the message length as the deciding factor for key wear? – John Price Mar 12 '14 at 14:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.