[cs631apue] Question about the key

[Ken Bodzak]

Please note that the EVP functions expect you to use a 128 bit key with the
Blowfish algorithm.

I have found that if you do not supply a large enough key to the
EVP_CipherInit_ex() function, it may cause undefined behavior.

Example:
unsigned char key[] = {1,2,3,4,5,6,7,8};  (64 bits)
EVP will attempt to use key[8]->key[15] which are out-of-bounds.

To use a 16 hexadecimal character key, you can append zeros to the key
until it is 128 bits long. This will mimic the behavior of the 'openssl
bf-cbc' command when given a key of 16 hexadecimal characters.

Example:
unsigned char key[] = {1,2,3,4,5,6,7,8,0,0,0,0,0,0,0,0}; (128 bits)
This should work. From what I have been able to test, this will also
produce the same output of the 'openssl bf-cbc' program when given to small
of a key.

Using too small of a key never actually caused any bad behavior for me, but
doing so will cause valgrind to go crazy about it.

I felt that I should share this because it seems to be poorly documented,
and a bit confusing since we are using a smaller key size.

Ken
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.stevens.edu/pipermail/cs631apue/attachments/20121129/beffc12b/attachment.html>