Symmetric ciphersLegacy - avoid
Blowfish and Twofish
Symmetric block ciphers
How it works
Both are Feistel ciphers designed by Bruce Schneier's teams and released without patents. Blowfish (1993) uses key-dependent S-boxes and a 64-bit block. Twofish was its successor and an AES finalist, with a 128-bit block and the same key lengths as AES.
Sizes: Blowfish: 64-bit block, 32 to 448-bit keys. Twofish: 128-bit block, 128, 192 or 256-bit keys
Status: Blowfish's 64-bit block is the problem; Twofish is not broken but AES is the standard choice.
Strengths
- Free to use with no licensing restrictions.
- Twofish has no practical attack against the full cipher.
- Blowfish's slow key schedule inspired bcrypt, which is still a sound password hash.
Weaknesses and known attacks
- Blowfish's 64-bit block makes it vulnerable to birthday-bound attacks like Sweet32 when large volumes are encrypted under one key.
- Neither is FIPS-approved, and Twofish has far less deployment and hardware support than AES.
Use it for
- Recognising older tools and archives that use them
- bcrypt (which is built on Blowfish) for password hashing
Don't use it for
- New designs, where AES or ChaCha20 is expected
Exam tip
Blowfish: 64-bit block, variable key up to 448 bits. Twofish: 128-bit block, AES finalist. Do not confuse either with bcrypt, which is a password hash derived from Blowfish.