This is a really basic question.
Blowfish is not seen as a secure cipher.
but bcrypt is one of the most secure hash functions.
So first: How can a hash function be based on an encryption algorithm, after all these two things have little to do with each other?
Second: If blowfish is insecure and bcrypt is based on it, how can it be secure ?
And just a little question regarding bcrypt: In Linux-based operating systems the code for hashes is

 $1 – MD5
$2 – blowfish
$2a – eksblowfish
$5 – SHA-256
$6 – SHA-512

With "blowfish" they actually mean bcrypt, right?

  • $\begingroup$ What is this code for hashes? $\endgroup$
    – Elias
    Mar 24, 2017 at 18:07
  • $\begingroup$ it is a sort of identifier like if the has begins with $1 you know that what comes after is md5 $\endgroup$ Mar 24, 2017 at 18:21
  • $\begingroup$ Right, this stuff en.wikipedia.org/wiki/Crypt_%28C%29 $\endgroup$
    – Elias
    Mar 24, 2017 at 18:34

1 Answer 1


This is just a sketch of the idea but I think the reasoning is as follows:

  1. The output of a good block cipher looks random so you can think of a block cipher as a PRF.
  2. If you have a PRF you can do simple things like throwing away half of the output to turn it into a compression function.
  3. Hash functions are traditionally built from such compression functions. Usually in a Merkle-Damgård construction.

Clearly the security of the Hash function depends on the security of all these building block and the precise steps taken in between.

Even if blowfish may have weaknesses it is possible that the output still has sufficient entropy that it can be turned into a good compression function. Note that according to Wikipedia the problem with blowfish is its small block size which doesn't affect the PRF property.

EksBlowfish is a step of bcrypt. As described in the publication.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.