The Blowfish Algorithm

Introduction

Blowfish was designed by cryptographer Bruce Schneier in 1993 as a fast, free, unpatented alternative to DES at a time when most strong encryption algorithms were either export-controlled or commercially licensed. Blowfish was released into the public domain from day one, and that openness — combined with genuinely solid security — made it enormously popular in software throughout the 1990s and 2000s, appearing in everything from OpenSSH to password-hashing schemes (via its derivative, bcrypt).

Table of Contents

• Design Goals
• How Blowfish Works
• Key-Dependent S-Boxes
• Security Status
• Blowfish’s Legacy: bcrypt and Twofish
• FAQ
• References

Design Goals

Schneier set out explicit design goals for Blowfish: it should be fast (encrypting at least as quickly as DES on 32-bit processors), compact (running in under 5KB of memory), simple (using only basic operations that are easy to implement correctly), and flexible (supporting variable key lengths from 32 up to 448 bits, so users could choose their own security/performance trade-off).

How Blowfish Works

Like DES, Blowfish is a Feistel cipher — it splits each 64-bit block into two 32-bit halves and repeatedly applies a round function to one half, XORing the result into the other, then swapping. Blowfish runs 16 rounds, each combining the right half with a round subkey from an 18-entry array called the P-array, then passing it through Blowfish’s distinctive F-function:

1. Split the 32-bit input into four 8-bit bytes: a, b, c, d.
2. Look each byte up in one of four separate 256-entry S-boxes: S1[a], S2[b], S3[c], S4[d].
3. Combine them: F = ((S1[a] + S2[b]) mod 2³²) XOR S3[c], then F = (F + S4[d]) mod 2³².

This mixture of table lookups, modular addition, and XOR — rather than pure bit permutation like DES — is part of what makes Blowfish fast in software: additions and XORs map directly onto simple CPU instructions.

Interactive Visualizer

The visualizer above demonstrates Blowfish’s genuine 16-round Feistel structure and F-function shape (splitting each half into bytes, running them through S-box-style lookups, and mixing with modular addition and XOR). To keep the demo approachable, it derives its S-boxes and subkeys from your key using a simplified key schedule rather than Blowfish’s exact production constants — see the note below for why.

Key-Dependent S-Boxes

Blowfish’s most distinctive design element is that its S-boxes aren’t fixed public constants like DES’s or AES’s — they’re derived from the encryption key itself, through an unusually elaborate key schedule:

1. The P-array and four S-boxes are initialized with fixed values derived from the digits of π (pi).
2. The key is XORed cyclically across the 18 P-array entries.
3. Blowfish then encrypts an all-zero 64-bit block using its own (partially initialized) algorithm, and uses the output to replace the first two P-array entries.
4. This process repeats — continuously encrypting the evolving output and using it to replace P-array and S-box entries — for 521 total iterations, until all 18 P-array entries and all 4×256 S-box entries have been replaced.

This means every unique key produces an entirely unique set of S-boxes, adding an extra layer of resistance to attacks that rely on known S-box structure — but it also means Blowfish’s key setup is comparatively slow, making it a poor fit for applications that need to rapidly change keys (this exact property was later deliberately repurposed as a feature in the bcrypt password-hashing algorithm, discussed below).

Reproducing this exact 521-iteration bootstrapping process (starting from ~1,042 published π-derived constants) is beyond the scope of this in-browser demo, which is why the visualizer above uses a simpler, faster key-derivation method to illustrate the same key-dependent-S-box concept.

Security Status

Blowfish’s core algorithm has held up well cryptographically — no practical attack breaks full 16-round Blowfish. Its real weakness is structural, not mathematical: like DES and 3DES, Blowfish uses a small 64-bit block size, making it vulnerable to the same Sweet32 birthday-attack class that affects 3DES when large volumes of data are encrypted under a single key in a long-lived connection. This is why Schneier himself now recommends Twofish (its 128-bit-block successor) or AES for new systems, while Blowfish remains acceptable mainly for legacy compatibility or short-lived, low-volume encryption needs.

Blowfish’s Legacy: bcrypt and Twofish

Blowfish’s slow, key-dependent S-box generation turned out to be extremely useful outside of raw encryption: the bcrypt password-hashing function deliberately repurposes Blowfish’s expensive key schedule as its core “work factor,” making brute-force password guessing computationally expensive by design — a clever reuse of what started as a performance quirk.

Schneier and colleagues later designed Twofish as a direct successor, entering it as an AES competition finalist, fixing Blowfish’s small block size (moving to 128 bits) while keeping the spirit of fast, key-dependent, software-friendly design.

FAQ

Is Blowfish still safe to use?

Its core cipher remains unbroken, but its 64-bit block size makes it unsuitable for encrypting large amounts of data under one key (see Sweet32). For new systems, use AES or Blowfish’s own successor, Twofish.

Why does Blowfish take so long to set up a new key?

Its key schedule runs 521 rounds of the cipher itself just to generate its S-boxes and subkeys, deliberately trading key-setup speed for stronger, key-unique substitution tables. This trade-off was later repurposed intentionally in bcrypt to slow down password-guessing attacks.

What’s the difference between Blowfish and Twofish?

Twofish is Blowfish’s successor, also designed by Bruce Schneier’s team: it uses a 128-bit block (fixing Blowfish’s Sweet32-style vulnerability), key-dependent S-boxes generated more efficiently, and was a finalist in the AES competition.

Can Blowfish use any key length?

Yes — from 32 bits up to 448 bits, one of its defining design flexibilities, letting implementers choose their own security/performance balance.

Why was Blowfish so popular in the 1990s?

It was released into the public domain, royalty-free and unpatented, at a time when strong cryptography was often export-restricted or commercially licensed — making it an attractive default for open-source software like OpenSSH.

References

1. Schneier, B. “Description of a New Variable-Length Key, 64-Bit Block Cipher (Blowfish).” 1993. Available at: https://www.schneier.com/academic/blowfish/

2. Wikipedia. “Blowfish (cipher).” Available at: https://en.wikipedia.org/wiki/Blowfish_(cipher)

3. Bhargavan, K. and Leurent, G. “Sweet32: Birthday Attacks on 64-bit Block Ciphers in TLS and OpenVPN.” 2016. Available at: https://sweet32.info/

4. Provos, N. and Mazières, D. “A Future-Adaptable Password Scheme.” USENIX 1999 (the original bcrypt paper).