# How does Blowfish avoid successful cryptanalysis? [closed]

I have researched the Blowfish algorithm and am curious as to why there exists no effective cryptanalysis for this algorithm as of yet. What basic principles or features allow Blowfish to achieve this?

• What do you mean with "effective cryptoanalysis"? You mean why it hasn't been broken? There has certainly been cryptoanalysis on Blowfish, and there seem to be results that make it less suitable for specific solutions. Nowadays you should try and use 128 bit or higher block ciphers. – Maarten Bodewes Oct 1 '14 at 23:47
• The blowfish key schedule is quite computation intensive (compared to other block ciphers). That might make it stronger than other ciphers with similar key and block size. But the block size of blowfish is too small for most usages today. – kasperd Oct 1 '14 at 23:49
• thank you for answering i appreciate it, this paper was what brought me to the question. All the proposed attacks in Section 3, "Cryptanalysis of Blowfish" never use the full 16 rounds. what part of the architecture prevents this? – ale g Oct 2 '14 at 0:57
• @owlstead: Can you give reference? I am not aware of attacks on the Blowfish algorithm (rather than: implementations thereof) which would represent a sizable threat in any semi-realistic use case. For example, I can't imagine an attacker exploiting Orhun Kara and Cevat Manap's A New Class of Weak Keys for Blowfish (in proceedings of FSE 2007). I'm rather on the impression that Blowfish is a rather fine cipher except for having a 64-bit block, lack of key agility, relatively high RAM usage, and significant hardware footprint. – fgrieu Oct 2 '14 at 5:33
• @fgrieu No I did assume a bit too much there in relation to the the weak keys... – Maarten Bodewes Oct 2 '14 at 13:12

The same way other ciphers, basically, only it does it better than some. From the Blowfish paper these were the relevant building blocks "demonstrated to produce strong ciphers" in previous designs:

• "Large S-boxes. Larger S-boxes are more resistant to differential cryptanalysis."
• "Key-dependent S-boxes. While fixed S-boxes must be designed to be resistant to differential and linear cryptanalysis, key-dependent S-boxes are much more resistant to these attacks."
• "Combining operations from different algebraic groups." (Blowfish uses XOR and addition modulo $2^{32}$.)
• "Key-dependent permutations. The fixed initial and final permutations of DES have been long regarded as cryptographically worthless."

The basic structure is a Feistel network, which has also been shown to produce secure ciphers provided the round function is good.

Of course, it's not a perfect cipher. For one, its 64-bit block size puts some restrictions on how we can use it securely. Its key setup is rather slow. There's also a class of weak keys for up to 14/16 rounds, which is quite close even if it allows no attacks. Schneier himself has been quoted as recommending people move to e.g. Twofish instead.