perlsameer has asked for the wisdom of the Perl Monks concerning the following question:

Hey Guys
I am using Crypt::Blowfish module, to encrypt my data. This
module encrypts the data but at the time of decryption output is some hexadecimal value.
My code for ENCRYPTION :: 
#!/usr/bin/perl
use Crypt::Blowfish;
my $key = pack("H16","0123456789ABCDEF");
my $cipher = new Crypt::Blowfish $key;
chomp(my $plaintext = $ARGV[0]);
my $ciphertext = $cipher->encrypt(pack("H16","sameer"));
print unpack("H16",$ciphertext),"\n";

[download]
My code for DECRYPTION :: 
#!/usr/bin/perl
use Crypt::Blowfish;
my $key = pack("H16","0123456789ABCDEF");
my $cipher = new Crypt::Blowfish $key;
chomp(my $ciphertext =$ARGV[0]);
my $plaintext = $cipher->decrypt(pack("H16",$ciphertext));
print "$plaintext","--\n";

[download]

can anyone help me, to find out the mistakes...

Replies are listed 'Best First'.
Re: Crypt Blowfish
by moritz (Cardinal) on Jul 15, 2008 at 12:06 UTC
    Just from a quick glance over your code: you pack your plaintext, but you never unpack it after the decryption.
[reply]
    A reply falls below the community's threshold of quality. You may see it by logging in.
Re: Crypt Blowfish
by ikegami (Patriarch) on Jul 15, 2008 at 17:15 UTC

    It's bad to encrypt directly using Crypt::Blowfish. Use it via Crypt::CBC.

    This computer is dying, so I can't go into the reasons right now, but you should be able to find them by searching for my earlier post mentioning Crypt::CBC.

[reply]
Re: Crypt Blowfish
by hawtin (Prior) on Jul 15, 2008 at 22:43 UTC

    If you use Blowfish directly you must also remember to supply data in the 8 byte chunks it wants. Here is another example of a working implementation: 

    # First encode $f2 into $f1 Encode data
my $cipher =  new Crypt::Blowfish $model_passphrase;

# Pad $f1 to the next 8 byte boundary
if((length($f2) % 8) != 0)
  {
    $f2 .= "\x00" x (8 - (length($f2) % 8));
  }

for(my $i=0;8*$i<length($f2);$i++)
  {
    $f1 .= $cipher->encrypt(substr($f2,8*$i,8));
  }

# Since we have to work on Windows don't forget
# the binmode() on the file handle

# Now to decode $f1 into $f2
if((length($f1) % 8) != 0)
  {
    $f1 .= "\x00" x (8 - (length($f1) % 8));
  }

my $cipher =  new Crypt::Blowfish $model_passphrase;
for(my $i=0;(8*$i)<length($f1);$i++)
  {
    $f2 .= $cipher->decrypt(substr($f1,8*$i,8));
  }
$f2 =~ s/\x00+$//s;

    [download]
[reply]
[d/l]

      Very bad recommendation. You added padding, but you're neither salting nor chaining. You are seriously undermining the encryption by using it directly instead of using Crypt::CBC.

      By avoiding Crypt::CBC, you're actually making the code longer and much more complex, risking the addition of errors and making it harder to maintain.

      It's not just speculative either. You added a bug. Any input matching /\x00\n?\z/ cannot be encoded.

      Blowfish is a secure algorithm, but like all algorithms, they're only secure when used properly.

[reply]

Back to Seekers of Perl Wisdom