# Why should CAST5 and 3DES not be used for encrypting files over 4GB?

On https://www.gnupg.org/faq/gnupg-faq.html#define_cast, it says that

Like 3DES, its 64-bit block size means it should not be used to encrypt files larger than 4Gb in size…

How and why does the block size affect the security of the cipher?

• This limit (which can be e.g. 4GB, depends on what chance of collision you are willing to risk) is per key. Therefore this limit is only if single key per encrypted file is used. Similarly, if multiple files are encrypted with same key, the upper bound is not size of any single file, but the size of the files combined. Sep 29 '14 at 16:35
• @user4982 Yes, but GPG usually creates a data or session key per file, and encrypts that with the public key of the intended receiver. So in that case it's per file again. Sep 29 '14 at 17:32

If you use a key for close to $2^{n/2}$ blocks in CBC mode, then the chance of getting a collision in the ciphertext is getting rather high because of the birthday paradox. As the ciphertext is used as a vector for the next calculation, and since that vector should be unpredictable, you would likely lose confidentiality.
Note that the author seems to have put his mark at about $1 / 148$ as the chance for a collision to occur (see the calculation by fgrieu in the comments). That may be either too low or too high depending on the context. That is if bytes are meant instead of bits, otherwise it would be $1/9445$ - a somewhat more sensible value most of the time, but you would be left with only 512 MiB for a single key.
• loose $\mapsto$ lose $\;$
• When using a 64-bit cipher in CBC mode, odds of collision after 4GiB ($k=2^{29}$ blocks) are $ϵ≈2^{65}/k^2=1/2^7=1/128$ (given that $1≪k≪2^{32}$). That's $ϵ≈1/148$ for 4GB, $ϵ≈1/8192$ for 4Gib, $ϵ≈1/9445$ for 4Gb [Reposted with fix and the whole four possible units that could be meant].