I have a system that signs plain text messages using a message authentication code (MAC) encrypted with 3-key Triple DES. The short message is used on connection to establish a session key, so it would take an attacker a long time to compile a lot of plaintext / MAC examples.
I need to establish a key expiration policy that says "keys shall be changed at interval X" to maintain security. What is a reasonable time limit considering only the cryptographic threats?
From the reading that I have done, I expect that a brute-force attack (Lucks attack, ref. rfc4772, effective 108 bits) is not practical within the lifetime of the system (30 years) and is not a threat that requires periodic changing of keys. Is this true?
There seem to be some attacks that benefit from compiling a lot of plaintext / ciphertext examples. A reasonable key policy would be to change the key before enough examples could be collected. What is a reasonable limit, considering the known attacks on Triple DES? Something I read (edit: http://tools.ietf.org/html/rfc4772) suggested 2^32 blocks was such a limit.