Blowfish Cypher

Angel has asked for the wisdom of the Perl Monks concerning the following question:

Dear fellow monks:

I am trying to develop a CGI sendable encryption scheme using blowfish to let CGI's talk to each other on different servers. Here is the question:

I use Crypt:Blowfish and a for loop to chop the string up into 8 byte pieces and feed them through the module.

   my @textCharacters = split( // , $plainText );

   for( $j = 0 ; $j <= ( length( $plainText  )/8 )-1 ; $j++ )
   {
       $z = "";

       for( $k = 0 ; $k <= 7; $k++ )
       {
         $i = $j*8 + $k;

         $z .= $textCharacters[$i];
       }

       print "STRING";
       print "Z = X $z X \n";

       my $cipher = new Crypt::Blowfish $key;
       $cryptText .= $cipher->encrypt( $z );
   }
[download]

This works fine save for the fact that get out many many "funky characters" such as :

7╞ Mbв[ёF%L;┴^Їе  X
[download]

These are making my telnet connection act odd as well as preventing the next step of the project which is remapping the chracterset of the Blowfish output into a simpler ( CGI Safe string ). I have that working for the ascii characters but not for the output characters that Blowfish puts out. I designed the remapping system to take the 256 chracters of the standard ASCII set:

 my @glyphs;
   my $plainText = $_[0];

   # Pad string to divisible by glyph choice
   my $padLength;

   if( length( $plainText ) % 3 ne "0" )
   {
      $padLength = 3 - ( length( $plainText ) % 3 );
   }
   $plainText .= " "x$padLength;
   print " pad = $padLength , $plainText X\n";


   # Convert text to ASCII
   @asciiCodes = unpack( "c*", $plainText );

   for( $j = 0 ; $j <= ( length( $plainText  )/3 )-1 ; $j++ )
   {
       my $sum = 0;

       for( $k = 0 ; $k <= 2 ; $k++ )
       {

         $i = ( $j*3 + $k );

         $sum += @asciiCodes[$i] * ( 65536 ** ( 2-$k ) );

       }

       push( @glyphs , $sum );

   }



   return( @glyphs );
[download]

and that will output a string of numbers that represent 4 characters. It does more after that but this is the start. The blowfish output characters causes this to return negative values. I though mabye that it is working on 16 bit characters like unicode does and I upped the alphabet size to 2^16 but I still get negative values.

Any ideas?

Comment on Blowfish Cypher Select or Download Code

Replies are listed 'Best First'.
Re: Blowfish Cypher by belg4mit (Prior) on May 11, 2002 at 23:42 UTC
There's some sort of answer below, but first... why? The CGI scripts will need a shared secret to communicate securely, how is this going to be arranged? I think you might want to look at setting up an ssh tunnel between the two machines if you are sincere about securely passing information amongst scripts. Now, for your question, in a fashion. You could look at using MIME to encode your binary data (UPDATE: since with large chunks you should be POSTing). Another alternative would be to use Crypt::CBC (which supports Blowfish), and the encrypt\|decrypt _hex methods. `-- perl -pew "s/\b;([mnst])/'$1/g"`	[reply]
(jeffa) Re: Blowfish Cypher by jeffa (Bishop) on May 12, 2002 at 23:17 UTC
I am probably flogging a dead horse at this point, but if you need to break a string up into 8 byte pieces, there are easier ways: `use strict; my $plainText = '123456781234567812'; my @piece = $plainText =~ /.{1,8}/g;` [download] This will create 3 elements in @piece, the last one has the 'left-overs'. Here is another that uses unpack: `my $plainText = '123456781234567812'; my $quo = length($plainText)/8; my $rem = length($plainText)%8; my $template = 'a8' x $quo; $template .= 'a'.$rem if $rem; my @piece = unpack($template,$plainText);` [download] The work to find the quotient and remainder of the string's length is used to create the right sized template to upack the data. In this example, $template will be 'a8a8a2' which means 8 null padded arbitrary bytes followed by 8 more followed by 2 more. I prefer the first method myself. ;) jeffa L-LL-L--L-LL-L--L-LL-L-- -R--R-RR-R--R-RR-R--R-RR B--B--B--B--B--B--B--B-- H---H---H---H---H---H--- (the triplet paradiddle with high-hat)	[reply] [d/l] [select]
Re: Blowfish Cypher by Sifmole (Chaplain) on May 13, 2002 at 14:30 UTC
I have done this in the past. First, jeffa's answer for the splitting up is much better. Second, CGI.pm has a nice urlencode function that I used to handle the "High" ascii characters of the resulting encrypted string.	[reply]