Why is Blowfish Cipher considered now "legacy" algorithm in OpenSSL?

Question

I am not a security expert, so please forgive me if the question is too obvious. We have been working with Blowfish to encrypt some of our files. We recently updated our very old OpenSSL version from 1.1.1 to 3.0.12 and we found out that Blowfish is considered a legacy algorithm and according to them "strongly discouraged".

Could you please explain why is "strongly discouraged" or point me to a good source for that information?

Answer 1

Blowfish is not totally broken, but it has two main security problems:

• it's a 64-bit block cipher, which is vulnerable birthday attacks,
• it's hard (impossible?) to make it resistant to timing attacks.

For more details, see Why don't we use Blowfish if it hasn't been cracked?.

These vulnerabilities require specific conditions to be exploited. For a birthday attack, the attacker needs multiple gigabytes of encrypted data. For a timing attack, the attacker would need access to the computer where the encryption runs. Blowfish can still be secure if used in a context where it doesn't encrypt gigabytes with the same key and doesn't allow anyone on the same computer.

However, you shouldn't use Blowfish for new systems; you should use AES. The only reason that you would use Blowfish is if you have an existing system that already uses it, which is precisely what "legacy" means.

Answer 2

From your link:

The following functions have been deprecated in 3.0.

BF_encrypt(), BF_decrypt(), BF_set_key(), BF_cbc_encrypt(), BF_cfb64_encrypt(), BF_ecb_encrypt(), BF_ofb64_encrypt()

See "Deprecated low-level encryption functions". The Blowfish algorithm has been moved to the Legacy Provider.

I could not find where it says Blowfish is "strongly discouraged".

This is not because it's Blowfish, but because it is a low-level function:

Low-level encryption functions such as AES_encrypt(3) and AES_decrypt(3) have been informally discouraged from use for a long time. Applications should instead use the high level EVP APIs EVP_EncryptInit_ex(3), EVP_EncryptUpdate(3), and EVP_EncryptFinal_ex(3) or EVP_DecryptInit_ex(3), EVP_DecryptUpdate(3) and EVP_DecryptFinal_ex(3).

The Blowfish algorithm is still considered secure, and is still supported by OpenSSL through the high-level functions.