Could anyone, please, tell me history of birth of Blowfish algorithm? Specifically, what is substantiation of Blowfish key length to be in range from 32 till 448 bits? Why, for example, it wasn't 64-512 so it's minimal key could be 2 times shorter than AES and maximal key could be exactly 4 times taller than AES with 256 bit key?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
Bruce Schneier's Description of a new variable-length key, 64-bit block cipher (Blowfish) (in proceedings of the first FSE conference, held Dec. 1993) defines that Blowfish's key is of 4 to 56 bytes (32 to 448-bit), with this rationale for the maximum:
The 448 limit on the key size ensures that
theevery bit of every subkey depends on every bit of the key. (Note that every bit of $P_{15}$, $P_{16}$, $P_{17}$, and $P_{18}$ does not affect every bit of the ciphertext, and that any S-box entry only has a $.06$ probability of affecting any single ciphertext block.)
Using more than 56 bytes of key for Blowfish is against its definition and design rationale: key bytes beyond the 72th have no effect whatsoever, and the few ones before may have somewhat less diffusion (though not nearly as badly as the above quote suggests). Some Blowfish implementations nevertheless accept keys with any positive number of bytes.
-
$\begingroup$ Unfortunately, I cannot find the 32 bit (4 byte) minimum in Schneier's paper. $\endgroup$– DennisCommented Mar 14, 2018 at 13:05
-
1$\begingroup$ @Dennis: the paper has a list of design decisions, including: "Have a scalable key, from 32 bits to at least 256 bits" (emphasis mine). Since it is customary to meet one's design decisions (when there's no obstacle), we can infer that the minimum size is 4 bytes. Admittedly, step 2 for generating Subkeys, could be interpreted as requiring a minimum of 8 bytes, since it mentions "the second 32-bits of the key", and the mention to "cycle through the key" comes only in the next sentence. $\endgroup$– fgrieu ♦Commented Mar 14, 2018 at 13:59