Symmetric Cryptosystems: DES, AES, RC4 and Blowfish

A block cipher maps one fixed-size block to another under a key. AES has a 128-bit block regardless of whether its key is 128, 192 or 256 bits. Block size and key size answer different questions.

Modes handle messages or storage units. CBC commonly uses padding for non-aligned messages, while CTR does not; a block cipher does not universally require PKCS#7 padding.

Stream constructions combine plaintext with generated keystream. Reusing the same keystream can expose relationships between plaintexts. Nonce requirements depend on the scheme and are not interchangeable with CBC IV rules.

Ciphertext size is a clue, not an identification test. Many formats share block alignment, prepend headers, omit stored nonces or encode their bytes. A multiple of 16 bytes plus an IV does not prove AES-CBC.

Identify formats using documented headers, metadata, application context and validated parsing. Report an unresolved cipher as unresolved rather than infer a banking protocol or integrity result from file size.

The mode determines how encryption handles data and what other checks are required. Preserve the actual IV/nonce, tag, associated data, counters and layout.

For GCM, a 96-bit nonce is the usual recommended construction, but the specification also addresses other lengths. The tag and nonce are not necessarily a fixed prefix and suffix or overhead repeated for each AES block.

XTS uses two component AES keys. The labels used by products can describe component or combined key lengths differently; document the actual configuration rather than infer it from a product name.

An authenticated-encryption verification failure can reflect the wrong key, changed data, parameters or incomplete acquisition. Do not release unauthenticated plaintext as verified merely because a parser produced plausible text.

Mode weaknesses do not imply AES itself is broken. Conversely, a strong cipher does not repair reused nonces, weak passwords, missing integrity or unsafe key handling.

DES uses a 64-bit block, 56 effective key bits and 16 Feistel rounds. Its small key space makes it unsuitable for modern protection; FIPS 46-3 was withdrawn in 2005.

Feistel rounds apply a round function to part of the state and combine it with the other part. Decryption can use the round keys in reverse order; this structural observation is not a security endorsement.

Triple-DES applies DES operations in an encrypt-decrypt-encrypt construction. Three-key TDEA has 168 nominal key bits but is commonly assigned about 112-bit security strength, with important block-volume limits.

Under NIST transition guidance, applying new TDEA protection was disallowed after 31 December 2023 and SP 800-67 Rev. 2 was withdrawn on 1 January 2024. Certain legacy processing, such as decrypting already protected material, was distinguished from applying new protection.

This is a scoped standards status, not a claim that historical decryption is forbidden worldwide. Record the relevant policy and use, including whether the system generates new ciphertext or reads an archive.

Practical recovery depends on keys, derivation, data and resources. Avoid fixed promises that every DES file is cheaply recoverable within a day. Weak passwords can undermine a stronger underlying cipher as well.

64-bit block ciphers reach birthday-scale collision concerns around 2^32 blocks, approximately 32 GiB. Sweet32-style plaintext recovery additionally needs a vulnerable construction and traffic conditions; this is not a universal instant-decryption threshold.

AES standardises selected Rijndael configurations: a 128-bit block and 128-, 192- or 256-bit keys with 10, 12 or 14 rounds respectively. FIPS 197 was updated editorially in 2023 without changing the algorithm.

Encryption starts with AddRoundKey. Ordinary rounds use SubBytes, ShiftRows, MixColumns and AddRoundKey; the final round omits MixColumns. The key schedule generates the round keys.

AES-128 and AES-256 have different key-search margins and costs. A wider key does not fix a compromised endpoint or weak password-derived key. Do not describe either as unconditionally secure against all attacks.

Hardware AES instructions can improve speed and avoid classic software table access patterns. Performance depends on the CPU, mode, implementation and workload; no universal cycles-per-round or 20× speed claim applies.

FIPS 197 defines AES; FIPS 140-3 concerns cryptographic-module validation. Naming AES does not establish that a whole application or module has a current validation certificate or operates in an approved configuration.

RC4 generates byte-oriented keystream using a permutation state. Its statistical weaknesses and protocol misuse make it unsuitable for new protection. RFC 7465 specifically prohibits RC4 cipher-suite negotiation in TLS.

Its presence in historical files, legacy services or malware is worth documenting, but does not alone prove a particular exploit, attacker or recovery cost. A long nominal key does not remove keystream biases.

Blowfish is a 16-round Feistel cipher with a 64-bit block and variable keys up to 448 bits. The small block size limits bulk-use safety even when the key is long; avoid recommending it for new general bulk encryption.

bcrypt uses an expensive Blowfish-derived key setup for password hashing. That does not mean password hashes are Blowfish-encrypted passwords or inherit a CBC traffic attack directly. Support and defaults vary by product.

Twofish is a distinct 128-bit-block AES finalist, not the same algorithm as Blowfish with a larger key. Other legacy ciphers should be identified from actual format documentation rather than presumed from a country or application.

ChaCha20-Poly1305 combines a stream cipher with authentication. The IETF construction specifies a 256-bit key and 96-bit nonce, with a 128-bit tag. Repeating a nonce under the same key violates its security requirements.

Performance relative to AES-GCM depends on available acceleration and implementation. ARM cryptographic extensions are distinct from x86 AES-NI; an ARM phone does not acquire AES-NI merely because it accelerates AES.

Compare effective security, construction limits and operational status rather than raw key length alone. There is no fixed practical “RC4 is 2^48–2^64” bound covering every format and attack.

Cryptographic-module boundaries, hardware instruction use and pure software are different implementation dimensions. An HSM may restrict export or permit authorised wrapped backups under policy; do not promise keys can never leave any HSM.

Constant-time software reduces relevant timing/cache leakage under its model. It is not a guarantee of constant power consumption, immunity to faults or absence of application-layer leaks.

Hypothetical technical example: an examiner receives an encrypted container, format metadata and a candidate recovery key. On a copy, they identify the mode and KDF, record parameters, attempt the supported operation and verify any authentication tag before interpreting plaintext.

If verification fails, retain the failure and check acquisition completeness and parameters. A plausible header recovered with an unverified method is not a proven authentic document. This method is country-neutral; legal access and reporting requirements vary by jurisdiction.

For signatures and certificate trust, continue to Asymmetric Cryptosystems, Hashing, PKI and Digital Signatures.