Blowfish is an encryption algorithm that can be used as a replacement for the DES or IDEA algorithms. Blowfish was designed in 1993 by Bruce Schneier as an alternative to existing encryption algorithms. Designed with 32-bit instruction processors in mind, it is significantly faster than DES. Since ...

learn more… | top users | synonyms

5
votes
2answers
215 views

Is my id obfuscation algorithm secure?

I'm designing an id obfuscation system. My system includes: Embedded chips, each chip has a unique 32-bit address (id). Server Insecure low-bandwidth unstable one-way channels from the chips to the ...
1
vote
0answers
63 views

Blowfish vs. Twofish regarding power consumption

If I wanted to use Blowfish or Twofish to provide security on a device where power consumption is crucial. Regarding power consumption, which one would win? Generally, which algorithms are known to ...
4
votes
2answers
99 views

Is it possible to construct a secure block cipher of size $2n$ given a secure block cipher of size $n$?

Given, say, the Blowfish block cipher, which is considered secure but only has a 64-bit block size, can we construct a secure block cipher of 128-bit block size? Say we run the key through two KDFs, ...
5
votes
2answers
423 views

How do decryption algorithms determine whether your attempted passphrase is correct?

Judging by the algorithm on the Blowfish Wikipedia article, there is no way for the process to fail with an error. How then does GnuPG know when to tell you your password is correct when decrypting a ...
1
vote
0answers
122 views

Rainbow tables and blowfish

I'm thinking of implementing rainbow tables for a specific blowfish problem, but I have trouble thinking of the proper way to apply the original paper (and its application to hash functions) to ...
3
votes
1answer
115 views

How would using only one s-box affect security of Blowfish?

Schneier says: Fewer and smaller S-boxes. It may be possible to reduce the number of S-boxes from four to one. Additionally, it may be possible to overlap entries in a single S-box: entry 0 ...
3
votes
2answers
127 views

Random session key + predictable IV

I'm using Blowfish in a toy Diffie-Hellman communications scheme. Random session keys are generated for each connection. In this case I can simply feed a null array to the IV right? The same ...
7
votes
0answers
565 views

Blowfish in CBC mode with multi-use keys. Is the 64-bit blocksize a fatal issue if one were to encrypt TBs of data?

Crashplan uses 448-bit Blowfish to encrypt the data you send them. The mode used is CBC, keys are multiple use, and IVs are generated with SecureRandom from JCE. Keys are not derived from the ...
7
votes
2answers
251 views

Is using EAX mode with a 64-bit block cipher a bad idea?

EAX mode produces an authentication tag no longer than the length of the underlying cipher's blocksize. So in the case of using Blowfish (a 64-bit block cipher) in EAX mode, the resulting tag would ...
7
votes
1answer
3k views

Why exactly is Blowfish faster than AES?

I've not been able to understand exactly the reason behind Blowfish being faster than AES. Is it dependent on the block size? Or is it processor dependent? (if Yes, then lets assume that AES ...
3
votes
2answers
795 views

Known-plaintext attack on Blowfish in ECB mode

The protection scheme I faced recently seems so weak nowadays that a simple exhaustive key search would be enough to recover the user key in an acceptable amount of time (it's OK, since almost no ...
3
votes
1answer
283 views

Understanding a Blowfish cryptanalysis

I'm reading a cryptanalysis on Blowfish, and I've come across something that I don't quite get. Let's denote $$\delta = a \oplus a'$$ where a and a' are bytes that cause a collision in some S-box ...
2
votes
1answer
531 views

Hashing a password with SHA256 on the client then bcrypt on the server

I'm trying to implement a cryptographically secured storage site (not Mega, or anything similar) and am trying to prevent the user's password from ever touching the server. The password is used to ...
2
votes
1answer
5k views

AES vs Blowfish taking key-length into account

I understand that Blowfish is getting old, but is still a secure algorithm, and that AES is very popular, and is recommended by most people. My question is, how do the two compare when a 256-bit key ...
1
vote
1answer
868 views

Blowfish: hex digits of pi used for s-boxes?

Preface: here is the official site for the Blowfish algorithm: http://www.schneier.com/blowfish.html The Blowfish algorithm uses an s-box, which consists of hex digits of pi (found here: ...
1
vote
1answer
277 views

Can iterated key expansion in Blowfish slow down bruteforce attacks on small key sizes?

Suppose I have to use 64-bit keys for encryption (e.g. to comply with export restrictions). For this question, assume this key is truly random, and the encryption algorithm is Blowfish. Blowfish key ...
1
vote
1answer
266 views

Blowfish Encryptions in Bcrypt hashing algorithm

I am trying to understand the ExpandKey function used in the bcrypt hashing algorithm. As per the documentation of bcrypt hashing algorithm on USENIX here: ...
6
votes
3answers
4k views

Is Blowfish strong enough for VPN encryption?

I'm looking at an OpenVPN connection between two sites configured to use 128 bit Blowfish in CBC mode, and trying to figure out how to assess the strength, but I just don't know enough of the maths. ...
9
votes
1answer
371 views

Can one efficiently iterate valid bcrypt hash output values?

bcrypt is an intentionally slow hash algorithm. In my last protocol idea, I wanted to use it to expand a password and then only transfer the bcrypt-hashed password. An efficient attack on this would ...