Crypto Blowfish in C++ Builder 5

[Thomas Wieczorek]

Hello,

i want to implement the Blowfish encryption in a Borland C++ Builder project. But when i execute the function in different TForms, i get different encryptions, e.g. ín the first form i get password = "§" and in the other form i get password = "%" when i want to encrypt the same string.

Here's my code:

[code]
AnsiString BlowfishString(AnsiString data, AnsiString dataKey, bool encode)
/*
generate a Blowfish key from dataKey and encrypt data with Blowfish
*/
{
unsigned char* ch = dataKey.c_str;

int l = (int) strlen(ch);

BF_KEY key;
//generate Blowfish key
BF_set_key(&key, l, ch);

/* OpenSSL need the ivec
"ivec must point at an 8 byte long initialization vector"
es genügt, wenn man ivec nur deklariert
*/
unsigned char ivec;

/* OpenSSL
"num must point at an integer which must be initially zero"
*/
int num = 0;


unsigned char* in = data.c_str();
long length = (long) strlen(data.c_str());
BF_KEY *schedule = &key;
//Encryption with Blowfish
//if encode == true, then encrypt

if (encode)
BF_cfb64_encrypt(in, in, length, schedule, &ivec, &num, BF_ENCRYPT);
//else decrypt
else
BF_cfb64_encrypt(in, in, length, schedule, &ivec, &num, BF_DECRYPT);

AnsiString s = StrPas(in);

return s;
}
[/code

Is there any problem with the variable "ivec" or is the mistake somewhere else?

Thank you, Thomas

[Marco Roeland]

Post by Thomas Wieczorek
...
Is there any problem with the variable "ivec" or is the mistake somewhere else?

The initialisation pointer must point to the same character array (of 8
bytes for blowfish) for both encrypting and decrypting. In your case,
by using an uninitialized pointer, you not only effectively generate a
different random encoding each time you use it (as you noticed) but it
is also surprising you didn't get a segmentation fault or something.

In general you can further better use the higher level routines like EVP
(see the man page for EvpEncryptInit) instead of directly using the
blowfish routines, but that is not the main problem here.