0
$\begingroup$

I am sorry if it sounds naive but I have been searching and searching regarding what kind of encryption we end up with if we use a key of length 32 characters?

This article https://www.embedded.com/design/configurable-systems/4024599/Encrypting-data-with-the-Blowfish-algorithm explains how the algorithm works on the plaintext quite clearly but nowhere do I find the difference a key length will make.

=========Edit==========
An example of key is 996b352b-beb9-5628-a61d-4f0fbb72844e

Improve this question
$\endgroup$
5
  • 5
    $\begingroup$ Ignoring the differences of [ascii] "characters" and bytes, assuming you meant real bytes. 32 "characters", or 32 bytes is 256-bits. Key size is distinct to the security of the function. I.e. Curve25519 has 256-bit keys with 128-bit security. $\endgroup$
    – cypherfox
    Commented Apr 18, 2018 at 6:59
  • 5
    $\begingroup$ If your characters are hex, then $\log_2(16^{32}) = 128$-bit key. $\endgroup$
    – cypherfox
    Commented Apr 18, 2018 at 7:01
  • $\begingroup$ Do you want to amend your title about the 32 bit thing? That's 4 bytes. $\endgroup$
    – Paul Uszak
    Commented Apr 18, 2018 at 23:03
  • $\begingroup$ A character is generally one byte but while a byte has 256 possibilities (8-bits) the number of characters per byte depends on the encoding. Best to start with understanding what A byte and a character is—Google is you find here.. $\endgroup$
    – zaph
    Commented Apr 18, 2018 at 23:03
  • $\begingroup$ @Surefoot The example key is a GUID representation and as such the - characters are just for a nice display. So the underlying value is 32-bytes of hexadecimal representing 128-bits. $\endgroup$
    – zaph
    Commented Apr 18, 2018 at 23:09

1 Answer 1

Reset to default
0
$\begingroup$

Well, it's a kind of marketing speak. If you look through the individual entries of this list of block ciphers, you'll see that they are categorised by two distinct parameters.

  1. Block size. This is the number of bits that the cipher operates on at a single time. Blowfish has a 64 bit block.

  2. Key size. Unsurprisingly, this is the length of the key.

These two parameters are somewhat independent, but key length >= block width. Blowfish's key can be up to 56 bytes, and all things being equal, the longer the key the higher the security level. Crypto guys tend to refer to bits though rather than bytes.

With reference to your question, I'd pick the longer number when telling someone about how secure my kit is. Otherwise you have to give out two numbers. You could say Blowfish128 if you want to say anything at all.

PS. Not sure if this matters to you, but the designer of Blowfish recommends using Twofish instead.

PPS. Further to some comments you've had, be aware that cryptographers would assume that your key consists of independently and uniformly distributed bytes, rather than text characters. Please do not confuse key with password. An error of understanding here can have very serious consequences for the security of your system. Your example key is actually $\operatorname{log_2}(16) \times 32 = 128 $ bits long. Modern crypto really warrants a minimum block width of 128 bits though to prevent various attacks, but that's a call only you can make.

Improve this answer
$\endgroup$
5
  • 1
    $\begingroup$ I believe Schneier, the main designer of Twofish, has stated he now uses AES. $\endgroup$
    – zaph
    Commented Apr 19, 2018 at 21:12
  • $\begingroup$ @zaph It's a shame he's lost confidence in it. Do you know why? $\endgroup$
    – Paul Uszak
    Commented Apr 19, 2018 at 21:23
  • 2
    $\begingroup$ I doubt that Bruce has lost confidence in Twofish, I have not seen that stated anywhere. I think it is simple: AES is The Advanced Encryption Standard. Among other things interoperability is a good reason to go with AES and there is now more experience and cryptanalysis on AES. This does not mean Twofish is not secure. $\endgroup$
    – zaph
    Commented Apr 19, 2018 at 21:33
  • 3
    $\begingroup$ ^ Plus, there are widely available CPU instructions for computing AES very quickly for relatively little code $\endgroup$
    – Ella Rose
    Commented Apr 19, 2018 at 21:38
  • 1
    $\begingroup$ @zaph For what it's worth, he doesn't seem to have even lost confidence in Blowfish (although recommends against it due to the small block size). $\endgroup$
    – forest
    Commented Apr 25, 2018 at 3:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.