>Twofish is almost entirely abandoned nowadays, but it still exists in >PGP and GnuPG. Once a bad decision is made in engineering, the >engineers are stuck supporting it forever. Is this statement really true or just opinion? Bruce Schneier is one of my favorite cryptoanalysts.