Blowfish (cipher)
In 1996, Serge Vaudenay found a known-plaintext attack needing 28r + 1 known plaintexts to break, where r is the number of rounds. Moreover, he also found a class of weak keys that can be detected and broken by the same attack with only 24r + 1 known plaintexts. This attack cannot be used against the regular Blowfish; it assumes knowledge of the key-dependent S-boxes. Vincent Rijmen, in his Ph.D. papers, introduced a second-order differential attack that can break four rounds and no more. Still there is no known way to break the full 16 rounds, apart from a brute-force search.