Blowfish was designed by Bruce Schneier in 1993 and uses symmetric encryption. It has a variable key length from 32 bits to 448 bits and uses a 64-bit block cipher.Although it still remains widely in use, AES is treated as the standard encryption method. It is also unpatented and royalty free and hence available for all users.Since it uses a 64-bit block cipher, it is not recommended to use Blowfish encryption on file sizes larger than 4gb. In fact, Schneier himself recommends using Twofish encryption instead.
While working in the Config XML i found that passwords are stored as Blowfish. Why are Passwords not stored as SHA-512?SHA-512 should be standard. Even the root users PW ist stored as Blowfish.Extract from Config File: <user> <password>$2y$10$################################
What is the real problem? Conducting the man page "$2y" means bcrypt. Bcrypt is not the same like Blowfish, even if the former is derived from it. As far as I know, Bcrypt is still considered secure for password based authentication. Correct me if I am wrong.Furthermore, it does not make sense only comparing the entropy of hash functions when used for password based authentication schemes.
