I am writing a simple messenger (as a proof of concept not for production), and I came across Blowfish as being as being an interesting alternative to AES.

As it is not meant to be an actual product, I am not entirely concerned with something like E2E encryption, nor do I want to deal with certificates, so my goal is to use just a mid-speed block cipher for encryption.

During my development, I noticed that there were options for ciphertext stealing. How big is the security benefit from using it, and what are the costs?

  • $\begingroup$ See Ciphertext stealing (it is not about security) and Maarten's answer. $\endgroup$ – zaph Nov 15 '17 at 18:23

Ciphertext stealing doesn't bring you any security benefits, although – if you're hell-bound on using CBC mode – it could avoid padding oracle attacks. Otherwise it is just a way to avoid padding the plaintext and therefore increasing the ciphertext size in CBC mode.

Ciphertext stealing is independent of the block cipher used. So you could use it with 3DES, Blowfish or indeed AES in CBC mode. It's also available in ECB mode but ECB mode itself is not considered secure.

Blowfish is not an interesting alternative to AES. Even Bruce Schneider, the principal engineer of the cipher, recommends against using Blowfish. Although it hasn't been broken its 64 bit block size makes it an uncomfortable fit to most modern modes of operation, especially those that use CTR underneath.

When using messaging you should probably have a look at AES/GCM or another mode of authenticated encryption. Ciphertext stealing is not that interesting, just use something based on counter mode such as GCM. CTR and most other modes of operation do not require padding nor ciphertext stealing.

Choice of the block cipher isn't that important; creating a secure protocol is much harder. Then you can drop in any modern, secure block cipher you want. To play it safe, just use AES.

| improve this answer | |
  • $\begingroup$ Had to make some changes. CTS could be used for CBC mode to avoid padding oracle attacks, but you're better off just using a different mode of operation that doesn't require padding at all. $\endgroup$ – Maarten Bodewes Nov 15 '17 at 19:11
  • 1
    $\begingroup$ It's worth mentioning that CTS has some limitations, e.g. it requires the input to have size at least one block. As for Blowfish, not only its block size is too low for comfort, but it has implementation issues as well: key schedule is slow as Hell, and the algorithm intrinsically makes lots of random accesses in an array, making it quite hard to make resistant to cache-based timing attacks. $\endgroup$ – Thomas Pornin Nov 15 '17 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.