For example what can you say about how susceptible Triple-DES is to a birthday attack due to the fact that it has a block size of 64-bits.


1 Answer 1


If you encrypt (partially) random values then the likelyhood that you encrypt the same value is larger for block ciphers that operate of fewer bits. If you encrypt the same value with the block cipher (which is a PRP) it will result in the same ciphertext. Identical ciphertext can be used by an attacker to retrieve information about the plaintext, breaking the mode of encryption.

For example, say you'd use a 64 bit block cipher for CTR (counter) mode encryption and you'd use 32 bit for a random nonce and 32 bits for the counter. The counter will simply repeat after $2^{32}$ block encrypts. The random nonce however is succeptible to the birthday problem. This means that you'd have a relatively high chance of a collision (with one of the earlier values) after generating only a few nonces.

As you can see above, the issue with the birthday problem above isn't with the block cipher itself. The problem lies within the mode of operation in which the block cipher is used. It is wrong to say that DES or TDES are succeptible to birthday attacks. 64-bit block ciphers are just not good candidates for modes of operation where the birthday problem may occur, especially if large quantities of data are concerned.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.