# Tag Info

15

Blowfish has strong points regarding speed because bulk encryption (and decryption) reduce to an alternation of: a 8->32-bit table lookup, and one or two 32-bit operations (addition or XOR). That structure is very well suited to 32-bit CPUs with a short pipeline and a fast cache of at least 4 kByte; and is well suited for a straight C implementation, which ...

9

Using EAX with a 64-bit block cipher is problematic, because the short block size causes some weaknesses due to internal collisions. I do not recommend it. Use a 128-bit block cipher. Indeed, the world has moved away from 3DES and towards AES exactly because of these fundamental problems with a 64-bit block size: the internal collision effect means that, ...

8

bcrypt uses Blowfish, which is a block cipher (albeit with a much enlarged key schedule). As such, Blowfish implements a permutation of the space of 64-bit blocks; and there should be no way to distinguish Blowfish (using a random key) from a permutation extracted at random, with uniform probability, from the set of permutations over 64-bit blocks (there are ...

6

Thomas mentioned some "theoretical weaknesses" that can happen with $2^{32}$ blocks of data with CBC mode and an 8 byte block cipher; I will explore more about what that weakness is, and its practical relevance. In CBC mode, we effectively send randomized data through the block cipher. However, there is a chance that it happens to encrypt the exact same ...

5

Both 3DES and Blowfish are from the same pre-2000 era. They both offer adequate security, in the sense of "have been around for some time, no known weakness". Yet, they also both operate on 64-bit blocks. This implies some issues when you begin to encrypt more than about $2^{32}$ blocks of data -- that's 32 gigabytes, a somewhat large but not at all huge ...

4

There seem to be some errors or inconsistencies in the question. If $P \oplus P' = [0000\delta 000]$, and we use the 2-round structure shown in the picture, then the corresponding ciphertext pairs should satisfy $C \oplus C' = [xyzt\delta000]$. This is different from what you wrote (did you omit the final swap shown in the picture above?). If we let ...

4

If you use CBC mode and your communication protocol looks like SSL, then you may have trouble. In SSL 3.0 and TLS 1.0, the IV for each record is the last block from the previous IV; this implies that an attacker who can both inject some data of his own in the stream, and observe the outcome, may know the IV for the next record and choose his data ...

4

Of those you listed, AES is the best to study. Not only is it the standard that is used everywhere, it has a huge literature of people explaining it and analyzing it, far larger than any of the others on your list. Also, compared to the others on your list it is easier to understand why AES strongly resists certain major classes of attack (like linear and ...

4

First, it is important to learn the basics behind all symmetric ciphers. You can get this from Handbook of Applied Cryptography, see Chapter 7, especially 7.1, 7.2, 7.3. If you understand those three sections, you will be off on the right foot. From there, I would suggest just diving right into AES. It isn't that terribly difficult (yes, there are easier ...

3

The quoted passage of the Wikipedia article is wrong does not at first reading seem to match Blowfish as in Bruce Schneier's Description of a new variable-length key, 64-bit block cipher (Blowfish) (in proceedings of the first FSE conference, held Dec. 1993) which for this same operation reads: XOR P1 with the first 32 bits of the key, XOR P2 with the ...

3

If there was a full 64-bit block of known plaintext, there would be a very fast attack using precomputation. You can build a precomputed table of all $2^{40}$ ciphertexts. Once you've got the precomputed table, recovering a key (given a ciphertext) would require just a single lookup in the table, so recovering a key would be extremely fast. Storing that ...

3

One method of doing this would be to construct a Feistel network using the n-bit blockcipher as a round function. A drawback of this approach is that because you're using a blockcipher (a pseudo-random permutation) in place of a pseudo-random function, you are almost immediately limited to being secure to only $q \ll 2^{n/2}$ queries as a result of the ...

3

An important property of a ciphertext is that it has to be indistinguishable from truly random data. This allows the encryption cipher to produce ciphertext that reveals no information about the plaintext (other than size) or the encryption key. In fact, this property even allows encryption algorithms to act as pseudorandom byte generators by simply making ...

3

I didn't find anything about the exact way Crashplan encrypts files, only that it uses Blowfish in CBC mode. The block size of Blowfish is 64 bit, so there are $2^{64}$ different input blocks and the same number of output blocks. All in all $147573953$ terabytes of different output data. The problem with this is the birthday attack. Summarized it says that ...

3

Triple DES has 168 bit keys, but due to the meet-in-the-middle attack only provides 112 bits of security. Blowfish supports up to 448-bit security. As neither cipher has published practical weaknesses, you are best off looking at key sizes to help you judge strength. Given that, if strength of cipher is your only metric in deciding which cipher to use, it ...

2

It is not really clear what you propose instead of the original algorithm - using ExpandKey(state, salt, key) instead of ExpandKey(state, 0, key)? What about the second call ExpandKey(state, 0, salt)?. You are right, each ExpandKey(state, 0, xxx) contains one XOR-ing of xxx into the P-array, and then Blowfish-encrypting multiple 64-bit blocks of zeros – in ...

2

A problem with your proposed solution is that the digest of the password is now "password equivalent". So, what does hashing it before sending it gain you? That said, I don't think either of your concerns are concerning (or should be concerning). For the first, see this. If anything, most passwords will have less than 256 bits of entropy anyways. For ...

2

Blowfish has a 64-bit block size whereas AES has a 128-bit block size, so you are sort of comparing apples and oranges (there are some things you can do in AES which would be unwise in Blowfish, in particular Blowfish in CTR mode can be distinguished from a random stream after only a few dozen gigabytes of output - see fgrieu's answer here, replacing 128 by ...

2

The same way other ciphers, basically, only it does it better than some. From the Blowfish paper these were the relevant building blocks "demonstrated to produce strong ciphers" in previous designs: "Large S-boxes. Larger S-boxes are more resistant to differential cryptanalysis." "Key-dependent S-boxes. While fixed S-boxes must be designed to be resistant ...

2

CMAC (or OMAC1) is the underlying MAC algorithm that provides authentication and integrity for EAX. Is stated in NIST SP 800-38B: Because CMAC is based on an approved symmetric key block cipher, such as the Advanced Encryption Standard (AES) algorithm that is specified in Federal Information Processing Standard (FIPS) Pub. 197 [3], CMAC can be ...

2

Because I didn't get any answer, I did some experments with Blowfish's F function and here are my observations: Because Blowfish's F function is not bijective, on average only every second value is returned and therefore different input can output same value (F(x) = F(y)). By reducing number of S-boxes this non-bijectivity becomes even worse. About 8 to 32 ...

2

One option is to encipher each number as follows: concatenate one 0 bit, the index for the number to encipher (or a random value) on 31 bits, and the 32-bit number to encipher, to form a 64 bit value with the leftmost bit at 0 encipher with blowfish (and a fixed secret key) if the leftmost bit of the result is set, loop to 2 output the 64-bit result (which ...

2

You say I have never studied a cipher before In that case I would recommend the following: Sign up for the Stanford online class on Cryptography on Coursera. This is a great introduction to Cryptography and this will conver block ciphers. Get a library card with your local public library and ask them to get some textbooks on Cryptography for you. ...

2

The -bf-ecb cipher is expanding the key to 128 bits by zero extending it. The output from -p is the telltale here: $openssl enc -bf-ecb -e -in plaintext.txt -out ciphertext.txt -nosalt -K FFFFFFFFFFFFFFFF -p key=FFFFFFFFFFFFFFFF0000000000000000 Blowfish is defined for 32-448 bit keys, and it appears the OpenSSL implementation chose 128 bits as the size ... 2 You are correct in that after the birthday bound you will leak some plaintext in random 8-byte blocks. Nova's answer has the specifics and links to useful sources. To give you a rough idea of the risk, you can look at what percentage of the data could leak. 10 TB is about$2^{40}$blocks. The expected number of collisions is$2^k (1-(1-2^{-n})^{2^k-1})\$, ...

1

No, the most you can do is to compare ciphertext blocks for equality and link those blocks with identical plaintext. That ECB is used does not hurt the security of Blowfish by itself. Block ciphers should not be vulnerable to known plaintext attacks, and there seems to be no known attack on Blowfish in this regard. To state it a bit more formally: that ECB ...

1

Regarding your brute-force Blowfish attack: I believe I may be familiar with the protection scheme you describe. It turns out that it may be even more broken that you'd expect from the description, in that a) the actual keyspace may be rather more limited than 40 bits and b) the author may not have been terribly aware of the consequences of using the ...

1

This may sound crazy and absurd, but it seems that this scheme is simply broken: on encryption, the last block is somehow padded (the exact method is not really relevant, but perhaps the trailing bytes of penultimate plaintext block are copied) and encrypted, then finally ciphertext is trimmed to match plaintext size; on decryption, the same buffer is ...

1

Yes. Blowfish's S-boxes serve a similar purpose as AES's S-box. The P-array is used as part of the key schedule, to make sure that each round is different (this helps prevents slide attacks and related-key attacks). I recommend you read the official specification of Blowfish and Wikipedia's article on Blowfish for more about the design rationale for ...

1

Something similar as what you suggest is already known as "Expensive key schedule Blowfish", or "EksBlowfish". It is the encryption algorithm in the core of Bcrypt (a slow hash function designed for password hashing). It also incorporates a salt, and its setup function is like this (retyped from the paper): EksBlowfishSetup(cost, salt, key): state ← ...

Only top voted, non community-wiki answers of a minimum length are eligible