The Twofish cipher

Twofish is a block cipher published in 1998 by Bruce Schneier, John Kelsey, Doug Whiting, David Wagner, Chris Hall and Niels Ferguson. It was one of the five finalists in the competition that chose AES. It lost, but nobody has broken it: after more than two decades, the best published attacks reach only part of its rounds. It's free to use, and it's the cipher Schneier suggests to anyone still using Blowfish.

How it works

Twofish encrypts a 128-bit block under a 128-, 192- or 256-bit key, in 16 rounds of a Feistel structure. The block is split into four 32-bit words and whitened by XORing in four subkeys. It then goes through the rounds and gets whitened again at the end.

Inside a round, two 32-bit words go through the g function. It splits a word into four bytes, sends each through a key-dependent S-box, and mixes the four results with a maximum-distance-separable (MDS) matrix, a mixing step with the best possible diffusion for its size, the same principle MixColumns uses in AES. A pseudo-Hadamard transform, borrowed from the cipher SAFER, adds the two results together, subkeys are added, and the words are XORed into the other half with some rotations. Since the S-boxes depend on the key, an attacker can't analyze them in advance, and that makes the usual statistical attacks harder. The design owes something to Blowfish (key-dependent S-boxes), to SAFER and to Square, the ancestor of AES.

The AES competition

NIST evaluated fifteen proposals over five years. The five finalists were Rijndael, Serpent, Twofish, RC6 and MARS. All five were judged secure. Rijndael won on a balance of security, speed in software and hardware, and ease of implementation. When it was introduced, Twofish was slightly slower than Rijndael with 128-bit keys and somewhat faster with 256-bit keys. Since 2008, when Intel and AMD processors gained AES instructions, hardware-accelerated AES has been far faster than software Twofish, and that's the main reason Twofish is rarely used where AES is available.

The five finalists side by side

All five used a 128-bit block. The competition's lesson is that "second best" meant little. The four losers were also judged secure, and the choice came down to speed and ease of implementation across smart cards, chips and software.

What key-dependent S-boxes buy and cost

Most ciphers, AES and DES included, have fixed S-boxes that cryptanalysts can study in advance. In Twofish, as in Blowfish, the S-boxes are built from the key. An attacker facing an unknown key faces unknown S-boxes too, so the statistical attacks that work by analyzing a fixed S-box have nothing fixed to analyze. The cost is setup time. Twofish lets the implementer choose between precomputing the S-boxes when a key is set (slow setup, fast encryption of long data) and computing their output on the fly (quick setup, slower per block). That suits a smart card differently than a server.

Security

The best published attacks are on reduced-round versions. A 1999 impossible differential attack breaks 6 of the 16 rounds of the 256-bit version. A truncated differential analysis of all 16 rounds, published in 2000, was judged by Schneier not to be a real attack, and he stated that Twofish isn't "remotely broken". In practice it's still an excellent cipher. Its patent status is clean: it isn't patented, and the reference implementation is in the public domain.

It appears in the OpenPGP standard (RFC 9580) and in disk-encryption tools such as VeraCrypt and its predecessor TrueCrypt, which offer Twofish as an alternative to AES. It's less widely used than Blowfish, and far less than AES.

Timeline

Common questions