Blowfish Encryption Draft » History » Version 17
Version 16 (johu, 02/10/2010 06:47 PM) → Version 17/33 (johu, 02/11/2010 01:43 AM)
h1. Blowfish Encryption
{{toc}}
h2. Introduction
Blowfish is a keyed, symmetric block cipher, designed in 1993 by Bruce Schneier and included in a large number of cipher suites and encryption products. Blowfish provides a good encryption rate in software and no effective cryptanalysis of it has been found to date. However, the Advanced Encryption Standard now receives more attention. Schneier designed Blowfish as a general-purpose algorithm, intended as a replacement for the aging DES and free of the problems and constraints associated with other algorithms. At the time Blowfish was released, many other designs were proprietary, encumbered by patents or were commercial/government secrets. Schneier has stated that, "Blowfish is unpatented, and will remain so in all countries. The algorithm is hereby placed in the public domain, and can be freely used by anyone."[1]
h3. IRC Profit
Blowfish can be used in IRC to encrypt messages between 2 persons in a query or messages in a channel and the topic too.
h3. Examples
* In XChat[2], Irssi[3] and mIRC[4] Blowfish support can be enabled with the FiSH plugin[5].
* Konversation[6] has a built in Blowfish support
h2. Development
h3. Related Issues
* #689 Blowfish Support (in development)
* -#61- Encrypted query (closed, will not implemented)
h3. Repository
The current development state can be found at http://gitorious.org/~johu/quassel/johus-quassel
> *Get the source*
<pre><code>git clone git://gitorious.org/~johu/quassel/johus-quassel.git</code></pre>
h3. TODO
* -Include QCA in build system- Tested in Linux *Need support for Windows, MaxOSX testing*
* -Cipher implemention- Class imported from Konversation, should works
* -include cipher in IrcUser and IrcChannel-
* -store keys for channel and user in Network-
* -commands setkey, delkey implementation- *have to be tested*
* -encrypt topic- encrypt topic
* -decrypt topic-
* -encrypt encrypt channel message- message
* -decrypt channel message-
* -encrypt encrypt query message- message
* -decrypt query message-
* output messages: -en-, cs, da, de, es, fi, fr, hu, it, nb, ru, sl, tr
h3. Library
The Blowfish algorithm is implemented in the *QCA* (Qt Cryptographic Architecture)[7] library. QCA works on all plattforms there are supported by QT including Unix, Windows and MacOSX. It is already included in Quassel build system at listed repository above.
h3. Commands
In first stable release of this feature in Quassel there will be 2 new user commands available.
a) setting a key for a user or channel
> Usage
<pre><code>/setkey <nick|channel> <key></code></pre>
b) deleting a key for a user or channel
> Usage
<pre><code>/delkey <nick|channel></code></pre>
h3. Current Plan
After short discussion in #quassel.de with Sput, krytzz and brot Blowfish encryption will be included in core. See section discussion below for more information. The only contra argument is the unsecure path between remote core and clientvin a untrusted net in case of no ssl connection is present. But the pro argument preponderate to strong. So i will revert the first plan to implement the de-/encryption in client.
The other result of this discussion is this wiki article.
h3. Discussion
There are two possible ways to implement Blowfish support in Quassel architecture:
*a) Client side de-/encryption*
!client_deencryption.png!
All messages will be de-/encrypted on client side.
*Pro*
* the complete path of messages from one client to an other is encrypted
* core have nothing to do
*Contra*
* Messages in backlog will be encrypted, that implies on receiving backlog all encrypted messages have to decrypt
* If key for a channel/user changed, old messages will stay decrypted
*b) Core side de- and encryption*
!core_deencryption.png!
All messages will be de-/encrypted on core.
*Pro*
* Backlog contains all decrypted messages
* Client do not need to decrypt on receiving backlog
* Key change doesnt matter
* Fits better in Quassel architecture
*Contra*
* The path between a core and client is unsecured if SSL is not enabled and it is not a monolitic build.
h2. References
[1] http://en.wikipedia.org/wiki/Blowfish_%28cipher%29
[2] http://xchat.org/
[3] http://irssi.org/
[4] http://www.mirc.com/
[5] http://fish.secure.la/
[6] http://konversation.kde.org/
[7] http://delta.affinix.com/qca/
{{toc}}
h2. Introduction
Blowfish is a keyed, symmetric block cipher, designed in 1993 by Bruce Schneier and included in a large number of cipher suites and encryption products. Blowfish provides a good encryption rate in software and no effective cryptanalysis of it has been found to date. However, the Advanced Encryption Standard now receives more attention. Schneier designed Blowfish as a general-purpose algorithm, intended as a replacement for the aging DES and free of the problems and constraints associated with other algorithms. At the time Blowfish was released, many other designs were proprietary, encumbered by patents or were commercial/government secrets. Schneier has stated that, "Blowfish is unpatented, and will remain so in all countries. The algorithm is hereby placed in the public domain, and can be freely used by anyone."[1]
h3. IRC Profit
Blowfish can be used in IRC to encrypt messages between 2 persons in a query or messages in a channel and the topic too.
h3. Examples
* In XChat[2], Irssi[3] and mIRC[4] Blowfish support can be enabled with the FiSH plugin[5].
* Konversation[6] has a built in Blowfish support
h2. Development
h3. Related Issues
* #689 Blowfish Support (in development)
* -#61- Encrypted query (closed, will not implemented)
h3. Repository
The current development state can be found at http://gitorious.org/~johu/quassel/johus-quassel
> *Get the source*
<pre><code>git clone git://gitorious.org/~johu/quassel/johus-quassel.git</code></pre>
h3. TODO
* -Include QCA in build system- Tested in Linux *Need support for Windows, MaxOSX testing*
* -Cipher implemention- Class imported from Konversation, should works
* -include cipher in IrcUser and IrcChannel-
* -store keys for channel and user in Network-
* -commands setkey, delkey implementation- *have to be tested*
* -encrypt topic- encrypt topic
* -decrypt topic-
* -encrypt encrypt channel message- message
* -decrypt channel message-
* -encrypt encrypt query message- message
* -decrypt query message-
* output messages: -en-, cs, da, de, es, fi, fr, hu, it, nb, ru, sl, tr
h3. Library
The Blowfish algorithm is implemented in the *QCA* (Qt Cryptographic Architecture)[7] library. QCA works on all plattforms there are supported by QT including Unix, Windows and MacOSX. It is already included in Quassel build system at listed repository above.
h3. Commands
In first stable release of this feature in Quassel there will be 2 new user commands available.
a) setting a key for a user or channel
> Usage
<pre><code>/setkey <nick|channel> <key></code></pre>
b) deleting a key for a user or channel
> Usage
<pre><code>/delkey <nick|channel></code></pre>
h3. Current Plan
After short discussion in #quassel.de with Sput, krytzz and brot Blowfish encryption will be included in core. See section discussion below for more information. The only contra argument is the unsecure path between remote core and clientvin a untrusted net in case of no ssl connection is present. But the pro argument preponderate to strong. So i will revert the first plan to implement the de-/encryption in client.
The other result of this discussion is this wiki article.
h3. Discussion
There are two possible ways to implement Blowfish support in Quassel architecture:
*a) Client side de-/encryption*
!client_deencryption.png!
All messages will be de-/encrypted on client side.
*Pro*
* the complete path of messages from one client to an other is encrypted
* core have nothing to do
*Contra*
* Messages in backlog will be encrypted, that implies on receiving backlog all encrypted messages have to decrypt
* If key for a channel/user changed, old messages will stay decrypted
*b) Core side de- and encryption*
!core_deencryption.png!
All messages will be de-/encrypted on core.
*Pro*
* Backlog contains all decrypted messages
* Client do not need to decrypt on receiving backlog
* Key change doesnt matter
* Fits better in Quassel architecture
*Contra*
* The path between a core and client is unsecured if SSL is not enabled and it is not a monolitic build.
h2. References
[1] http://en.wikipedia.org/wiki/Blowfish_%28cipher%29
[2] http://xchat.org/
[3] http://irssi.org/
[4] http://www.mirc.com/
[5] http://fish.secure.la/
[6] http://konversation.kde.org/
[7] http://delta.affinix.com/qca/