in reply to Re: Re: Re: Encryption/Decryption
in thread Encryption/Decryption

Let's take Crypt::RC5 as an example. It's a block cipher, so it can't be used safely without a mode like CBC (the "default" mode, ECB, leaks a lot of information and is very vulnerable to block-shuffling replay attacks). There's a nice module, Crypt::CBC, which adds CBC support to any compatible block cipher, but Crypt::RC5 is not compatible (it doesn't define the blocksize and keysize methods, and its constructor has an extra required parameter). So although Crypt::RC5 does appear to be a correct implementation of RC5, it's basically useless because you need to code the CBC padding and chaining stuff yourself if you want to use it securely. Mr. Kincaid refuses to listen to this type of criticism, preferring instead to argue that it's not his job to make sure people write secure code with his modules.

Crypt::RC5 appears to have made a half-hearted attempt at supporting CBC mode. There's a decrypt_iv function which seems to do CBC mode decryption, but it's undocumented, doesn't handle padding, and there's no corresponding encrypt_iv.