The Patching Friars' AlmanacA calendar of CVE saints

Patron of October 25

Sweet32Holy card for sweet32, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 64 64 != Sweet32 PARVUS BLOCUS CADIT
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Sweet32, Martyr of the 64-Bit Ciphers

Patron of 3DES and Blowfish ciphers, TLS sessions that last a lifetime, and blocks that are too small.

Life

On 25 October 2016 Karthikeyan Bhargavan and Gaëtan Leurent of INRIA revealed Sweet32: 64-bit block ciphers like 3DES have a space so small that, after about four billion blocks in the same session, collisions start to reveal pieces of plaintext. They showed they could recover a cookie from an HTTPS session kept open long enough. Since then 3DES has been slowly retired from the protocols.

Prayer

O Saint Sweet32, who waits patiently for the collision, let our ciphers have large blocks and short sessions. Amen.

How to celebrate

Celebrated by disabling 3DES and the other 64-bit ciphers and choosing AES, with a sweet on the side.

Small block, certain collision.

Technical record

Disclosed on
October 25 2016
CVE
CVE-2016-2183CVE-2016-6329
CVSS
7.5

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

Sources: sweet32.info

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.