Tag Info

Blowfish has strong points regarding speed because bulk encryption (and decryption) reduce to an alternation of: a 8->32-bit table lookup, and one or two 32-bit operations (addition or XOR). That structure is very well suited to 32-bit CPUs with a short pipeline and a fast cache of at least 4 kByte; and is well suited for a straight C implementation, which ...

bcrypt uses Blowfish, which is a block cipher (albeit with a much enlarged key schedule). As such, Blowfish implements a permutation of the space of 64-bit blocks; and there should be no way to distinguish Blowfish (using a random key) from a permutation extracted at random, with uniform probability, from the set of permutations over 64-bit blocks (there are ...

Thomas mentioned some "theoretical weaknesses" that can happen with $2^{32}$ blocks of data with CBC mode and an 8 byte block cipher; I will explore more about what that weakness is, and its practical relevance. In CBC mode, we effectively send randomized data through the block cipher. However, there is a chance that it happens to encrypt the exact same ...

Both 3DES and Blowfish are from the same pre-2000 era. They both offer adequate security, in the sense of "have been around for some time, no known weakness". Yet, they also both operate on 64-bit blocks. This implies some issues when you begin to encrypt more than about $2^{32}$ blocks of data -- that's 32 gigabytes, a somewhat large but not at all huge ...

It is not really clear what you propose instead of the original algorithm - using ExpandKey(state, salt, key) instead of ExpandKey(state, 0, key)? What about the second call ExpandKey(state, 0, salt)?. You are right, each ExpandKey(state, 0, xxx) contains one XOR-ing of xxx into the P-array, and then Blowfish-encrypting multiple 64-bit blocks of zeros – in ...

Triple DES has 168 bit keys, but due to the meet-in-the-middle attack only provides 112 bits of security. Blowfish supports up to 448-bit security. As neither cipher has published practical weaknesses, you are best off looking at key sizes to help you judge strength. Given that, if strength of cipher is your only metric in deciding which cipher to use, it ...

Blowfish has a 64-bit block size whereas AES has a 128-bit block size, so you are sort of comparing apples and oranges (there are some things you can do in AES which would be unwise in Blowfish, in particular Blowfish in CTR mode can be distinguished from a random stream after only a few dozen gigabytes of output - see fgrieu's answer here, replacing 128 by ...

There seem to be some errors or inconsistencies in the question. If $P \oplus P' = [0000\delta 000]$, and we use the 2-round structure shown in the picture, then the corresponding ciphertext pairs should satisfy $C \oplus C' = [xyzt\delta000]$. This is different from what you wrote (did you omit the final swap shown in the picture above?). If we let ...

A problem with your proposed solution is that the digest of the password is now "password equivalent". So, what does hashing it before sending it gain you? That said, I don't think either of your concerns are concerning (or should be concerning). For the first, see this. If anything, most passwords will have less than 256 bits of entropy anyways. For ...

Yes. Blowfish's S-boxes serve a similar purpose as AES's S-box. The P-array is used as part of the key schedule, to make sure that each round is different (this helps prevents slide attacks and related-key attacks). I recommend you read the official specification of Blowfish and Wikipedia's article on Blowfish for more about the design rationale for ...

Something similar as what you suggest is already known as "Expensive key schedule Blowfish", or "EksBlowfish". It is the encryption algorithm in the core of Bcrypt (a slow hash function designed for password hashing). It also incorporates a salt, and its setup function is like this (retyped from the paper): EksBlowfishSetup(cost, salt, key): state ← ...