1

I am quite new to encryption and recently played around with blowfish (openssl's implemenation).

I am using a 23 character password (case-sensitive alphanumeric random). I estimate the entropy to be roughly 128 Bit (-> wikipedia password strength).

My question would be: If someone would acquire my encrypted text, how long would it take him/her to bruteforce it? How would yout answer differ if it were a big player (three letter agencies...)

Edit:

Also, blowfish seems to be quite old, Wikipedia states that Bruce Schneier would recommend twofish instead (though not available via openssl).

What does this mean and does it have any practical conseqeunces?

"Four rounds of Blowfish are susceptible to a second-order differential attack (Rijmen, 1997);[1] for a class of weak keys, 14 rounds of Blowfish can be distinguished from a pseudorandom permutation (Vaudenay, 1996)." [src: https://en.wikipedia.org/wiki/Blowfish_%28cipher%29"]

Improve this question

2 Answers 2

Reset to default
4

The difficulty of brute-forcing your ciphertext depends on what key size you used when encrypting: Blowfish has an adjustable key size, ranging from 32 bits to 448 bits; this size is independent of the complexity of your password. At the 32-bit end of things, your ciphertext could be decrypted in a matter of minutes, while at 128 bits or larger, it would take longer than the remaining lifetime of the universe.

What your quote means is that simplified versions of Blowfish have attacks that are faster than brute force. From a practical standpoint of attacking it, it means that for longer key sizes, an attacker is better off researching attacks than trying to guess the key, because there's a good chance they'll be able to find a practical attack.

Improve this answer
1

Blowfish has known key-weaknesses that can lead to the discovery of your plaintext if you happen to pick a vulnerable key. Mark's answer is also fairly accurate, smaller keys equals easier cracking time, and with larger keys it is almost impossible to brute-force. Since Blowfish has key-vulnerabilities, it has been replaced with newer versions (Twofish and Threefish)

If it is something you are concerned about, larger key-sizes are always going to be your best friend, and some encryption implementations can use key-sizes of up to 4096-bits. It's probably not necessary, but nothing is going to break that for the foreseeable future.

Depends on what you are wanting to hide ;)

And as far as your edit goes: Some ciphers apply the algorithm multiple times in order to get more pseudo-random looking. Blowfish with weak keys has those stated vulnerabilities after 4 and and 14 rounds specifically. Some ciphers will use more rounds to prevent those issues.

Improve this answer
2
  • 2
    For most symmetric-key algorithms, a key size of 128 bits is adequate protection against brute force: even if the entire universe were turned into the most efficient computer possible, it would be unable to try every key before heat death. Asymmetric cyphers require longer keys, because there are mathematical restrictions on what values a key can have (eg. "key must be a pair of prime numbers").
    – Mark
    Commented Oct 3, 2014 at 21:28
  • 1
    128-bit keys could be broken by such a 'universal' computer, as it would have an unimaginable computational power. Example: If there was one computer operating at one attempt per second per cubic mile in the -known- universe, you would have ~8.3*10^70 attempts per second, and the total keys for 128-bit keys is ~3.4*10^38, so it'd be cracked in short order. But for any computer that we can manufacture, you are right, it would take an endless amount of time. (256-bit keys are another story!)
    – Desthro
    Commented Oct 7, 2014 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .