Introduction to Blowfish
       -The New Kid on the Block-

     This article assumes you know at least a little bit about encryption in general. If you don't, you will be completely lost. BELIEVE ME. (or you can read "Encryption for Dumbassess" elsewhere in this issue)

What is Blowfish?

     Blowfish is a block-encryption algorithm developed by Bruce Schneier, and originally released (public domain) in the Spring of 1994. It uses a 448 bit secret key and a 64-bit blocksize, uses a symetric algorithm, and encrypts plaintext 16 rounds. The Macintosh implementation of Blowfish (called MacBlowfish) is included with this archive.

How does it work?

Subkey - As with most modern public encryption techniques, this algorithm uses a very complex key.

(Much of this info is from the original docs and algorithm. I have adapted it for my own purposes. I'm only including the basic code for key generation since the encryption and decryption code is widely available and easy to understand)

P-array: The P array consists of 18 32-bit subkeys. 

P1, P2, P3,...
(etc)

S-Boxes: There are 4 32-bit S-boxes with 256 entries each.
S1,0, S1,1, S1,2,...
S2,0, S2,1, S2,2,...
S3,0, S3,1, S3,2,...
(etc)

When Blowfish attempts to create a random key it initializes the P-array and S-boxes in order with the hexadecimal digits of "Pi", starting from the 0.1 place.

for i := 1 to 18 do

P1[i] := GetPiDigit(i);

for i := 0 to 255 do

S1,0[i] := GetPiDigit(i+19);

for i := 0 to 255 do

S1,1[i] := GetPiDigit(i+257);

for i := 0 to 255 do

S1,2[i] := GetPiDigit(i+513);

for i := 0 to 255 do

S1,3[i] := GetPiDigit(i+787);

Next, it will go through the P-array, "xoring" the entry with a 32-bit value. (generated from the password)

Len : Byte;

PassStr : String;

Password : Array of LongInt;

Move(PassStr, password, Length (PassStr) );

Len := Length (PassStr);

if Len mod 4 <> 0 then Inc (Len);

for i := 1 to Len do

   for j := i to Len do

      P1[j] := P1[j] xor password [j];

for i := Len downto 1 do

   for j := Len downto i do

      P1 [j] := P1 [j] xor password [j];

Then it encrypts an all-zero string with the S-boxes and replaces P1 and P2 with the value.

zeros : TCipherBlock;

zeros[0] := 0;

zeros[1] := 0;

zero := Encrypt (zero);

Parray[1] := zeros[0];

Parray[2] := zeros[1];

Lastly, it fills out the rest of the P-arrays and S-boxes, using the encrypted string.

i := 3;

while i <> 18 do

begin

zero := Encrypt (zero);

P1[i] := zeros [0];

P1[i+1] := zeros [1];

Inc (i,2);

end;

i := 0;

while i <> 255 do

begin

zero := Encrypt (zero);

S1.0[i] := zeros [0];

S1,0[i+1] := zeros [1];

Inc (i,2);

end

Encryption - After we have a key, we can now encrypt or decrypt your file. (remember, you use the same key for both!) Blowfish encryption uses two parts: the F function and the main encryption function.

The F function divides the key (32-bits) into four values and encrypts them using the S-boxes. Then the main encryption function encrypts a 64-bit long block. (2 LongInts)

Decryption - Basically the same as encryption only it switches the P-array. (thus doing it backwards)

Closing thoughts

     Blowfish is FAST. Using a PowerPC you could probably encrypt a gigabyte in under 10 minutes or so. This is my main reason for reccomending it for private file security. (The key is NOT public like PGP) It seems to be very secure, resisting all brute force attacks to date. For the Macintosh platform, this seems to be the best solution.

The Weasel