2

So I ran openssl speed md5 && openssl speed blowfish and blowfish seem quicker than md5.

Here are the results (ran on windows WSL).

$ openssl speed md5 && openssl speed blowfish
Doing md5 for 3s on 16 size blocks: 11438181 md5's in 3.00s
Doing md5 for 3s on 64 size blocks: 8164424 md5's in 3.00s
Doing md5 for 3s on 256 size blocks: 4405667 md5's in 3.00s
Doing md5 for 3s on 1024 size blocks: 1547154 md5's in 3.00s
Doing md5 for 3s on 8192 size blocks: 212233 md5's in 2.95s
OpenSSL 1.0.1f 6 Jan 2014
built on: Mon Jan 30 20:38:38 UTC 2017
options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) blowfish(idx)
compiler: cc -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
md5              61003.63k   174174.38k   375950.25k   528095.23k   589360.25k
###############################################################################
Doing blowfish cbc for 3s on 16 size blocks: ^T21511383 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 64 size blocks5410400 blowfish cbc's in 2.84s
Doing blowfish cbc for 3s on 256 size blocks: 1438809 blowfish cbc's in 2.98s
Doing blowfish cbc for 3s on 1024 size blocks: 355336 blowfish cbc's in 2.97s
Doing blowfish cbc for 3s on 8192 size blocks: 42136 blowfish cbc's in 2.96s
OpenSSL 1.0.1f 6 Jan 2014
built on: Mon Jan 30 20:38:38 UTC 2017
options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) blowfish(idx)
compiler: cc -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
blowfish cbc    114727.38k   121924.51k   123602.38k   122513.15k   116614.23k

Now, I know blowfish is used by bcrypt, and I know bcrypt is a slow algorithm, so how come I get these results where blowfish is so fast ?

I have got a few hypotheses about this, but no way to check them :

  • Is that related to being on windows subsystem on linux ?
  • Is that related to the COST of bcrypt, and for instance openssl speed blowfish runs with a cost of 1 (or the likes)
  • Is this blowfish not the same as bcrypt's blowfish

Or of course, something else.

  • bcrypt is a very different thing than blowfish – Josef Jul 4 '17 at 8:39
  • 7
    @PierreAntoineGuillaume Bcrypt is a password hash (and thus designed to be slow). Blowfish is a blockcipher (designed to be fast). They are not the same thing. – CodesInChaos Jul 4 '17 at 9:47
  • 1
    Only for 16-byte blocks... Read it more closely. At block size 8192: 589 megabytes/second processed with MD5 and 116 megabytes/second with blowfish? – immibis Jul 4 '17 at 10:27
  • 2
    FYI you can do multiple algorithms in a single command/process: openssl speed md5 blowfish – dave_thompson_085 Jul 5 '17 at 5:59
9

First, I think you're misinterpreting your results. If for example we look at 1024-size blocks, MD5 is doing 1,547,154 in 3 seconds while Blowfish is only doing 355,336, and so is taking more than four times as long per operation as MD5.

Second, bcrypt iterates Blowfish key setup a configurable number of times, typically 4,096. Try running your test again, but comparing one iteration of MD5 with 4,096 iterations of Blowfish, and see which is faster. So yes, it's the COST parameter in bcrypt setup.

  • Let's say I have 16 UTF-8 char-long string I want to encrypt. Is the 1024-size block the most relevent in this case ? – Pierre-Antoine Guillaume Jul 4 '17 at 7:41
  • If I get it right, the first blowfish transforms the password in a hash, and the others are significantly slower because the hash is longer than the password ? – Pierre-Antoine Guillaume Jul 4 '17 at 9:10
  • Note that thanks to Moore's law, that 4096 (work factor 12) will want increasing in a year or so. – OrangeDog Jul 4 '17 at 11:34
  • @OrangeDog Oh, that is nice, I accept it. – Pierre-Antoine Guillaume Jul 4 '17 at 14:41
3

Since bcrypt is used to store passwords, preventing brute force guessing attacks is essential. If it only used one round of a very fast hash, an attacker could guess much more quickly than if more work was required.

In the case of bcrypt, the non-secret cost value defines how many rounds of costly encryption are used. This is still relatively fast if the user knows the password...

2

bcrypt and blowfish are related but very different.

Blowfish is an symmetric encryption algorithm. It takes a user supplied password, applies a key expansion functions and then uses this derived key to encrypt the plaintext

On the other hand, bcrypt is a password hashing function. It is related to blowfish in the sense that it uses the same key expansion function multiple times to hash the password in a slow and irreversible way.

As you can see those are not the same.

About md5, it's not a password hashing function. It's a general purpouse hashing algorithm. They serve different purpouses, md5 attempts to be a FAST hashing function. The password hashing function derived from md5 is md5crypt, which was used in old *nix OSs and replaced by bcrypt, shaXcrypt and others in later versions

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.