New answers tagged

2

Is it still secure to keep using the more-than-two-decades-old Blowfish AES (Rijndael) is from 1998 while Blowfish from 1993, i.e. only 5 years older. Which means the age of an algorithm does not say that much about its strength. Looking at the wikipedia article one will see a few interesting points which make the algorithm attractive: public domain ...


2

You could ask this question with hundreds of encryptions. Why is Windows 10 using SHA1, which has been convincingly broken since ages? And despite MD5 has been proven not to be safe as well, many companies still use it for integrity checks. In the whole area of information security, you have a visible gap between what would theoretically be more secure and ...


1

Blowfish is secure enough for TLS/SSL but AES is preferred. Especially 256, because 128 is still considered unbreakable and 256 is even more secure.


8

PHP uses bcrypt for password_hash(), but since PHP is PHP, they have to maximize confusion, so they call it "Blowfish". Besides being a family of highly poisonous fish, Blowfish is a block cipher for more than 20 years ago. Bcrypt is a password hashing function that happens to be derived from an internal block cipher which is similar to Blowfish -- but it ...


0

Currently, password_hash is designed to be compatible with crypt(), which supports a limited range of hash algorithms. Of the supported algorithms, Blowfish is the only cryptographic algorithm: DES is known to be weak, and has a very short hash (2 character) Extended DES is little better MD5 is far too fast to use for password hashing - it is possible to ...


3

PHP's password_hash uses the bcrypt hashing function. This is close to state-of-the-art for password storage with perhaps scrypt lined up as its successor. While you don't give a link for Schneier's (not corrected spelling) comment, I suspect that he was talking about the blowfish encryption algorithm. While bcrypt is based on blowfish, it is not ...



Top 50 recent answers are included