in reply to line by line Encryption fun with Crypt::CBC and Rijndael? File Ownership issues?

You will have to restart the decryption process for each block of data. The encrypted data consists of the constant "Salted__" followed by an eight byte salt value. You can't concatenate separately encrypted blocks together because those headers are treated very differently than regular data.

But in fact, it's only if you are on a fairly recent version of Crypt::CBC that you will have headers that start with "Salted__". Otherwise...

... otherwise take a large aspirin and ponder this ominous note in the documentation for Crypt::CBC version 2.22:

IMPORTANT NOTE: Versions of this module prior to 2.17 were incorrectly using 8-byte IVs when generating the "randomiv" style of header, even when the chosen cipher's blocksize was greater than 8 bytes. This primarily affects the Rijndael algorithm. Such encrypted data streams were not secure. (emphasis the author's)
My humble opinion is that openssl would be a somewhat safer choice in terms of maturity and the number of eyes on the code. Crypto modules in general are notorious for subtle lurking exotic bugs that have no effect on anything, other than making your data much easier to steal than you would like to think. That was true centuries ago, it was true when the Enigma was invented, and it still seems to be true today.

If you think that Crypt::CBC is a good choice, consider this: Crypt::CBC with Rijndael is supposed to be the same as openssl enc -aes-128-cbc. Or is is -aes-192-cbc? Or -aes-256-cbc? (I checked and it's actually -aes-256-cbc, but I couldn't actually find anywhere that said that in the documentation.)

If you really want to use Crypt::CBC you at least want to go with the very latest version. Be positive that /dev/urandom exists and is known to work on your kernel. (If it doesn't Crypt::CBC will fall back on the Perl built-in random number generator, which is a Very Bad Thing cryptologically.) And keep a sharp eye out for later releases that might have more bug reports in them....

(and ditto on the disclaimer: I'm not a crypto guru either!)

  • Comment on Re: line by line Encryption fun with Crypt::CBC and Rijndael? File Ownership issues?

Replies are listed 'Best First'.
Re^2: line by line Encryption fun with Crypt::CBC and Rijndael? File Ownership issues?
by hmbscully (Scribe) on Dec 04, 2007 at 15:16 UTC
    We had seen that ominous note and we have version 2.24 of Crypt::CBC.

    The reason I'm using Crypt::CBC is because it was suggested to me somewhere previously when I was pondering encryption. I honestly don't understand this stuff as much as I should. We originally looked at openSSL, but then I was told I had to use the AES standard which, after investigation, we thought was the Rijndael implementation.

    I'm going to take the fairly large aspirin now...


    I learn more and more about less and less until eventually I know everything about nothing.
      You could use openssl enc -aes-256-cbc. That's probably the best compliance with the notion of "standard" that you could find.

      Be careful not to pass the encryption key as an environment variable, since the environment variables can be visible in ps in most Unix-like operating systems. And do double check that you have a usable /dev/urandom.