# What Is Sweet32 (CVE-2016-2183)? Definition and Examples

> Sweet32 is a 2016 birthday attack (CVE-2016-2183) on 64-bit block ciphers such as 3DES in CBC mode that recovers secrets from very long-lived TLS connections.

Source: https://ssl.sh/glossary/sweet32/
Last updated: 2026-11-10

Sweet32 was published in 2016 by Karthikeyan Bhargavan and Gaëtan Leurent. Block ciphers with a 64-bit block, notably [3DES](https://ssl.sh/glossary/3des/) and Blowfish, start producing colliding ciphertext blocks in CBC mode after about 2^32 blocks, roughly 32 GB of data, by the birthday bound. A collision reveals the XOR of two plaintext blocks; if one is known and the other contains a repeated secret such as a cookie, the attacker can recover the secret. The researchers demonstrated it against HTTPS with 3DES and against OpenVPN with Blowfish by keeping a single connection open while generating large volumes of requests.

## Why it matters
The attack needs an enormous amount of traffic over one connection, so it is not easy to carry out, but it showed that 64-bit block ciphers are unsuitable for modern data volumes. 3DES has since been phased out of browsers and TLS libraries' default configurations, and [TLS 1.3](https://ssl.sh/glossary/tls-1-3/) allows only AEAD ciphers with 128-bit blocks or stream constructions, such as [AES-GCM](https://ssl.sh/glossary/aes-gcm/) and ChaCha20-Poly1305. The practical fix on servers is to remove every 3DES suite (for example `TLS_RSA_WITH_3DES_EDE_CBC_SHA`) from the cipher list.

## Example
```bash
nmap --script ssl-enum-ciphers -p 443 example.com | grep -i 3des
```

No output means no 3DES suites are offered. An explicit nginx cipher list without them:

```nginx
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
```

## Common misconceptions
- **3DES is safe because its key is long.** Sweet32 does not attack the key; it exploits the 64-bit block size, which key length does not change.
- **Sweet32 decrypts any 3DES connection quickly.** It needs tens of gigabytes or more on one connection; the lesson is to retire 64-bit ciphers, not that every short session is exposed.
- **Removing 3DES breaks modern clients.** Every current browser supports AES-GCM or ChaCha20-Poly1305; only very old clients depend on 3DES.

## Related terms

- [3DES](https://ssl.sh/zh/glossary/3des/): 3DES 是把 DES 连续执行三次的分组密码，分组长度只有 64 位，主要因 Sweet32 攻击而在 TLS 中被视为应淘汰的旧算法。
- [密码套件](https://ssl.sh/zh/glossary/cipher-suite/): 密码套件是 TLS 客户端和服务器协商使用的一组命名的加密算法组合，例如 TLS_AES_128_GCM_SHA256，决定连接用什么算法保护数据。
- [AES-GCM](https://ssl.sh/zh/glossary/aes-gcm/): AES-GCM 是以伽罗瓦/计数器模式运行的 AES 分组密码，属于 AEAD 算法，用计数器模式加密、用 GHASH 认证标签保证完整性。
- [ChaCha20-Poly1305](https://ssl.sh/zh/glossary/chacha20-poly1305/): ChaCha20-Poly1305 是把 ChaCha20 流密码与 Poly1305 认证算法组合而成的 AEAD 算法，专为纯软件实现时的高速和恒定时间而设计。
- [AEAD](https://ssl.sh/zh/glossary/aead/): AEAD 是带关联数据的认证加密算法，一次运算同时完成数据加密和完整性认证，并能保护不加密的附加数据不被篡改。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。