twofish keysize

Per Tunedal Casual pt at
Tue Apr 20 15:02:45 CEST 2004

At 09:26 2004-04-19, Werner Koch wrote:
 >On Mon, 19 Apr 2004 00:19:58 +0200, Malte Gell said:
 >> Maybe he expects a performance advantage when using 128 bit keys instead
 >> of 256 bit. By the way, are there estimations how much slower a 256 bit
 >> Twofish key is? I guess one will only notice it whith huge amount of
 >here are encrypt/decrypt result from libgcrypt.
 >           ECB             CBC             CFB             CTR
 >           --------------- --------------- --------------- ----------------
 >3DES         140ms   150ms   170ms   190ms   150ms   160ms   180ms   180ms
 >CAST5         50ms    50ms    70ms    80ms    60ms    60ms    90ms    80ms
 >BLOWFISH      90ms   100ms   110ms   120ms   110ms   110ms   130ms   130ms
 >AES           40ms    40ms    50ms    60ms    40ms    50ms    80ms    80ms
 >AES192        40ms    40ms    60ms    60ms    50ms    50ms    80ms    80ms
 >AES256        40ms    50ms    60ms    70ms    50ms    60ms    90ms    80ms
 >TWOFISH       50ms    50ms    60ms    60ms    60ms    60ms   100ms   100ms
 >TWOFISH128    50ms    50ms    60ms    60ms    60ms    60ms   100ms   100ms
 >As you can see, there is no difference between twofish (256 bit) and
 >twofish 128.
 >The disadvantage of a 256 bit key is that is requires double as much
 >entropy to create a session key.
How large files where used in this performance test? I recently read a NIST 
evaluation: For 256-bit keys TWOFISH was slightly faster than AES on (very) 
large files.

BTW I've been told it isn't wise to encrypt files larger than a few MB 
using a block size of 64 bits. What's the limit for the block size 128 
bits, used in the new AES and TWOFISH ciphers? And what's the problem?
Per Tunedal

More information about the Gnupg-users mailing list