Page "Blowfish (cipher)" Paragraph 11

In 1996, Serge Vaudenay found a known-plaintext attack requiring 2 < sup > 8r + 1 </ sup > known plaintexts to break, where r is the number of rounds.

Moreover, he also found a class of weak keys that can be detected and broken by the same attack with only 2 < sup > 4r + 1 </ sup > known plaintexts.

This attack cannot be used against the regular Blowfish ; it assumes knowledge of the key-dependent S-boxes.

Vincent Rijmen, in his Ph. D. thesis, introduced a second-order differential attack that can break four rounds and no more.

There remains no known way to break the full 16 rounds, apart from a brute-force search.