21.4 Sweet32
SWEET32 [30] is a generic attack against block ciphers with a block size of 64 bits in CBC mode, such as DES or 3DES. However, it has special relevance for TLS because until TLS 1.1, 3DES was mandatory to implement for a TLS library, and TLS 1.2 still contains corresponding cipher suites.
21.4.1 The attack
Recall that in the CBC mode of some block cipher Fk, the i-th plaintext block Pi is encrypted as
If a large amount of plaintext is encrypted, there might be another plaintext block Pj that generates the same cipher block. Such an occurrence is called a collision. In this case, we have
This means the input block to Fk must be the same:
or finally,
As the right-hand side is known, the attacker learns Pi ⊕Pj. This knowledge can be useful in these cases:
If some secret information Pi, for example, an authentication cookie, is repeatedly sent by the victim
If some portion Pj of the plaintext is known
These two conditions are usually fulfilled in HTTP...