IV Re-use and Chosen Plaintext against 56bit Blowfish (CBC)

Question

I am looking at a very old protocol which uses Blowfish to encrypt packets with a constant 8-byte IV in CBC mode.

Assuming I have:

• The ability to arbitrary encrypt known plaintexts
• The IV

I know that this lets me identify which plaintexts begin with an identical block and lets me identify also which plaintexts are exactly identical (since the cipher texts will remain identical until the first divergent block).

Is there any information which IV-reuse might leak that could be used to reduce the brute-force space for a dictionary attack or otherwise learn additional information about the plaintext?

I know that there are several theoretical weaknesses in Blowfish (such as this reflection attack against weak keys) but I am not sure if IV-reuse makes it possible to identify weak keys with less data than the hundreds of gigabytes proposed in those attacks.

Answer 1

No.

You're already assuming that chosen plaintext attacks should be considered. A known IV together with your ability to arbitrary encrypt known plaintexts is enabling exactly that attack vector to the block cipher. These attacks are all attacks on the block cipher, and Blowfish is considered rather secure, if deprecated because - among others - the block size. A mode of operation cannot influence the security of the block cipher itself, and CBC is still considered a secure mode of operation when it comes to storing data confidentially.

What you can do is attack the cipher or protocol in different ways. You say that Blowfish is used to encrypt packets, so it could be that CBC/PKCS#7 based padding oracle attacks apply. If no message authentication has been performed a lot of other plaintext oracle attacks could also become available. If the authentication is optional you can always try padding oracle attacks while leaving the authentication out (this seemingly idiotic strategy used to work against Web-security frameworks). There are quite a surprising number of attacks to transport security, so if they still use Blowfish you can almost be sure that it is not completely secure.