Return to Question

Since Blowfish is old, well-audited, and has no published attacks, why are we using AES instead? I know that Bruce Schneier said that Blowfish is insecure and told people to transition to Twofish, but why? AES has many vulnerability such as padding oracle attacks, power-consumption analysis, but Blowfish doesn't have any well known issues. And Blowfish can take a key up to 448 bits, which is larger than AES's 256 bits. Is there something I am not understanding? It's been under public scrutiny for the longest with the least issues.

Perhaps it is because of Blowfish's small block size?

Context: Is it safe to use Blowfish to encrypt strings of less than 30 characters?

Since Blowfish is old, well-audited, and has no published attacks, why are we using AES instead? I know that Bruce Schneier said that Blowfish is insecure and told people to transition to Twofish, but why? AES has many vulnerabilities, such as padding oracle attacks and power-consumption analysis, but Blowfish doesn't have any well-known issues. And Blowfish can take a key up to 448 bits, which is larger than AES's 256 bits. Is there something I am not understanding? It's been under public scrutiny for the longest with the least issues.

Perhaps it is because of Blowfish's small block size?

Context: Is it safe to use Blowfish to encrypt strings of less than 30 characters?

Since Blowfish is old, well-audited, and has no published attacks, why are we using AES instead? I know that Bruce Schneier said that Blowfish is insecure and told people to transition to Twofish, but why? AES has many vulnerability such as padding oracle attacks, power-consumption analysis, but Blowfish doesn't have any well known issues. And Blowfish can take a key up to 448 bits, which is larger than AES's 256 bits. Is there something I am not understanding? It's been under public scrutiny for the longest with the least issues.

Perhaps it is because of Blowfish's small block size?

Context: Is it safe to use Blowfish to encrypt strings of less than 30 characters?

Thanks in advance.

Since Blowfish is old, well-audited, and has no published attacks, why are we using AES instead? I know that Bruce Schneier said that Blowfish is insecure and told people to transition to Twofish, but why? AES has many vulnerability such as padding oracle attacks, power-consumption analysis, but Blowfish doesn't have any well known issues. And Blowfish can take a key up to 448 bits, which is larger than AES's 256 bits. Is there something I am not understanding? It's been under public scrutiny for the longest with the least issues.

Perhaps it is because of Blowfish's small block size?

Context: Is it safe to use Blowfish to encrypt strings of less than 30 characters?

Since Blowfish is old, well-audited, and has no published attacks, why are we using AES instead? I know that Bruce Schneier said that Blowfish is insecure and told people to transition to Twofish, but why? AES has many vulnerability such as padding oracle attacks, power-consumption analysis, but Blowfish doesn't have any well known issues. And Blowfish can take a key up to 448 bits, which is larger than AES's 256 bits. Is there something I am not understanding? It's been under public scrutiny for the longest with the least issues.

Perhaps it is because of Blowfish's small block size?

Edit

Full context: I would like to cascade multiple encryption algorithms to encrypt multiple passwords. I'm wondering if Blowfish is suitable, because there's no point in including a broken cipher. The passwords are no more than 32 bytes, only ASCII. The master key is derived from the master password with SHA3_512, PBKDF2, and Scrypt. I am also planning to add Argon (version not decided yet) as per the comments and answers have suggested. Thanks for all the answers and comments, they are really valuable.

Thanks in advance.

Since Blowfish is old, well-audited, and has no published attacks, why are we using AES instead? I know that Bruce Schneier said that Blowfish is insecure and told people to transition to Twofish, but why? AES has many vulnerability such as padding oracle attacks, power-consumption analysis, but Blowfish doesn't have any well known issues. And Blowfish can take a key up to 448 bits, which is larger than AES's 256 bits. Is there something I am not understanding? It's been under public scrutiny for the longest with the least issues.

Perhaps it is because of Blowfish's small block size?

Context: Is it safe to use Blowfish to encrypt strings of less than 30 characters?

Thanks in advance.