Well, things are getting weirder.. I double-checked on the old server, looking for all files named CBC.pm - and the only one I found in my @INC does have "version 2.02" in the source. But I did notice that I upgraded the module earlier this year from version 1.20. The perl program I use for encryption runs as a daemon and hasn't been restarted since I upgraded Crypt CBC on that server.
Is it possible that the daemon perl script could be using the older CBC module, ignoring the upgraded one?
I did try installing CBC version 1.20 on the new server, and the older IDEA as well, and now the output length is 16 like in the old system. (btw it was 48, not 50 chars; I ++'d where I should have --'d)