I've read about the weak key issue with Blowfish, but can't seem to find anything that explains the practical effect of weak keys on Blowfish with the full 16 rounds.

Is there any actual attack upon non-reduced-round Blowfish, in the event that a weak key is chosen?

  • $\begingroup$ There is an attack that allows distinguishing 14 rounds of Blowfish, under the assumption of a weak key. Are you referring to this? $\endgroup$
    – Aleph
    Jul 17 '15 at 9:05
  • $\begingroup$ I've heard of that attack, but as I understand it that attack only works on 14 out of a full 16 rounds for Blowfish, and only allows an attacker to distinguish blowfish from random. I was more wondering if the weak keys actually allow plaintext recovery, key recovery, or even a distinguishing attack on the full 16 rounds. $\endgroup$
    – Blowfish
    Jul 18 '15 at 1:20
  • $\begingroup$ As far as I know the attack only applies to 14 rounds, not to the full 16 rounds. $\endgroup$
    – Aleph
    Jul 18 '15 at 17:21
  • $\begingroup$ Apparently (according to wikipedia) there's no attack on full-round blowfish. The best cryptanalyis without weak keys breaks 4 (/16) rounds, the best with weak keys breaks 14 (/16) rounds. So weak keys are extremely useful in the cryptanalysis of this cipher but they don't suffice for a full break. $\endgroup$
    – SEJPM
    Jul 18 '15 at 20:22

Yes there is an (unrealistic) attack on weak keys in Blowfish. Basically I just extend Vaudenay's original collision into the s-box to more collisions. The key space of Blowfish is so large that some keys will have many collision. Finding such a key is near impossible however.

There is also the more recent reflection keys attack on Blowfish that are quite interesting.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.