Blowfish Symmetric Encryption Algorithm

Blowfish is a symmetric encryption algorithm or, in other words, a mathematical formula that uses the same secret key both to encrypt and decrypt messages. Blowfish was designed by one of the world's leading cryptographers, Bruce Schneier, in 1993 as an alternative to existing, but less secure, algorithms such as Data Encryption Standard (DES).

History

Bruce Schneier specifically designed the Blowfish algorithm as an unlicensed, uncopyrighted alternative to DES and first presented it at the Cambridge Algorithms Workshop in 1994. Since that time, Blowfish has been extensively tested by the cryptographic community and found to be reasonably secure.

Block Cipher

Blowfish is what is known as a 64-bit block cipher, which means the algorithm and encryption key are applied to a block of data 64 bits, or 8 bytes, long, rather than single bits. Each fixed-length block of unencrypted data, known as plaintext, is transformed into a block of encrypted data, or ciphertext, of the same length. The 64-bit block size is short by modern standards and, while the Blowfish algorithm is perfectly adequate for standard consumer applications, such as email, it is less suitable for encrypting large volumes of data, such as those encountered in data archival.

Encryption Key

The Blowfish symmetric encryption algorithm uses a variable length encryption key, which can range in length for 32 bits to 448 bits, with a default of 128 bits. The longer the encryption key, the higher the number of possible combinations and the stronger the encryption. The Blowfish algorithm actually consists of two parts: a key expansion part, in which the encryption key is converted into an array of subkeys, and a data encryption part. By contrast, DES uses a 64-bit key, and only 56 bits are actually randomly generated and used by the encryption algorithm; the remaining 8 bits are used for error correction.

Operation

The Blowfish algorithm performs 16 iterations, or rounds, each of which consists of a permutation dependent on the encryption key and a substitution dependent on the encryption key and the data. Each operation is a logical EXCLUSIVE OR (XOR) -- which returns true if either, but not both, of its operands are true -- and addition on 32-bit words. A typical implementation of the Blowfish algorithm can encrypt or decrypt a 64-bit block of data in approximately 12 clock cycles, while a 128-bit message requires 24 clock cycles and so on in linear fashion.

References

• IBIMA Publishing: Performance Evaluation of Symmetric Encryption Algorithms
• Bruce Schneier; The Blowfish Encryption Algorithm -- One Year Later; B. Schneier; September 1995
• Design & Reuse; Encrypting Data with the Blowfish Algorithm; Bill Gatliff; July 2003