Eg: > Avoid: AES-CBC, AES-CTR by itself, block ciphers with 64-bit blocks --- most especially Blowfish, which is inexplicably popular, OFB mode. Don't ever use RC4, which is comically broken.
Why not 64-bit blocks? What's wrong with them? How do they affect us?
Mind you, I'm not saying the statement is incorrect, but with no justification for it, I'm not convinced why I should avoid them.
The right way to learn about cryptography is to start by learning how to break it. If that's something you're willing to sink time into, try this thing we set up:
It's totally free and by the send of set 3, you'll have an appreciation for block sizes.
But I always thought that Crypto Pals was a Matasano project. He should know if someone took up the mantle in his absence.
Okay, very glad to hear that there's still work being done on that end. I'll start sending solutions in then :3
For people on larger teams, or working next to teams of developers, "use X not Y" will lead to pushback of "why not?" and full answers will be needed.
If you're feeding effectively random data into the block cipher (like if you're using CBC), then because of the birthday paradox, you get at most about 2^32 blocks (far fewer in practice at a good security level) per key if you have 64-bit blocks. This is low enough to be annoying for designers or problematic for suites that don't rekey correctly.
However, because CTR (or GCM) mode uses sequential inputs to the cipher, I think that a 64-bit block size would not be a problem there. At that point, the reason not to use 64-bit block ciphers is because they're all older, weaker, and less-supported than AES-128.