Password Safe [1] was designed by Bruce Schneier, that could fit the bill. It seems to have done quite well in the paper cited by xenophonf in [2], too.

[1] http://passwordsafe.sourceforge.net/

[2] https://news.ycombinator.com/item?id=9727522

Looking the C++ code for this project, this appears to be unauthenticated TwoFish in ECB mode.

(I thought, no, no way is this actually ECB mode, maybe they just did the XOR'ing for CBC mode outside the TwoFish class, but no: they appear to pad blocks explicitly to block boundaries and then ECB them.)

I looked for a total of 4 minutes, so if someone wants to correct me...

You need to look at the PasswordSafe file format. It can be found here (among other places):

http://sourceforge.net/p/passwordsafe/git-code/ci/333dd9f23a...

ECB mode is only used for the internal keys. The database records are encrypted in CBC mode, and there is an integrity authenticator HMAC as well. However, the format was designed in the days when Mac-then-encrypt was considered proper. So the authentication HMAC is over the plaintext prior to encrypting.

Yes, @tehjh on Twitter pointed this out. The CBC code is in Util.cpp, _readcbc; it appears to be length-delimited instead of padded, so there's probably another error oracle in the decoding of the length/type block.

Also: in PWSfileV3.cpp, are they HMAC'ing the IV?

This is interesting; we might be able to make an exercise out of it.