Why is Threefish not widely used?

Question

I haven't seen Threefish widely used. For example, I've seen Twofish used in file encryption software, even though it was not standardized, but I've never seen Threefish. Are there security issues?

Answer 1

I've asked Bruce Schneier if they would provide a good mode for encryption. However, I don't think they were directly interested at that point as they were in the final phases of the SHA-3 competition.

I asked because there are some benefits in using a block cipher with a larger block size, mainly where it comes to avoiding collisions for random IV/nonces and/or counter blocks for counter mode. I didn't hear back, but at that time I also didn't have time to upgrade my own Skein / Threefish implementation, so maybe they wanted me to update first.

One reason that I asked is because I wasn't sure if the number of rounds was tweaked for being used as a block cipher. Threefish uses a relateively simple round function with a large number of rounds.

As it currently stands, Skein didn't succeed to win the competition, and everybody put their weight on the Keccak sponge. Several ciphers have been defined for Keccak or derivatives. Others looked at the fast Blake family of hashes and tried to improve those. That basically left Threefish out of the lime-light.

If you want to use a cipher with a 512 bit internal state then you can use ChaCha20, which is rather efficient in software. You can use XChaCha20 if you want to have a large nonce size as well, and you can combine it with Poly1305 if you want an efficient, secure authenticated cipher.