Crashplan uses 448-bit Blowfish to encrypt the data you send them. The mode used is CBC, keys are multiple use, and IVs are generated with SecureRandom from JCE. Keys are not derived from the password, but are generated randomly. MACs used are MD5 or SHA1.
The more I do research on Blowfish the more it sounds like the 64-bit block size is totally insufficient for the size of the volumes they will be backing up.
I've read that especially in certain modes (like CTR) it is totally insufficient for large streams of data, and can be distinguished from random data after only gigabytes? However, other stuff I've read seems to indicate this isn't an issue if properly implemented.
Would such an attack not apply to Crashplan's implementation?
With this sort of implementation does the 64-bit block size become an issue other than simply being distinguishable from random data after 'x' GB, or would there be greater issues if one were to encrypt say 10TB of data, such as plaintext leaks?
Keep in mind I'm using Crashplan's third option where I generated my own key which is supposedly never sent to Crashplan's servers and the client encrypts all data before sending to their servers. So I don't think transport is an issue? Correct me if I'm wrong.
Another question deals with the Blowfish weak key reflection attack, and is this something I should be worried about? Is there a relatively easy way to check if I'm using a weak key? Or does this just not apply to my situation?
I can make Crashplan backup to a folder on my PC and it seems to encrypt files the same way it would before sending to Crashplan's cloud. I could try to analyze data encrypted with my key if I actually knew what I was doing, but I don't. So, My final question is how would I begin to start analyzing this data if I wanted to try to crack my own stuff or find weaknesses in their implementation? What tools should I use? I'm interested in crypto and would like to learn more.
[This is a follow-up to a question I asked on Stack Overflow.]