From:             [EMAIL PROTECTED]
Operating system: RH 7.0
PHP version:      4.0 Latest CVS (22/01/2001)
PHP Bug Type:     mcrypt related
Bug description:  Blowfish encryption not "correct"

The way PHP encrypts using Blowfish doesn't seem to be compatible with the published 
"standard" test cases.

I've mentioned this to the author of libmcrypt, and he fixed part of the problem (see 
the CVS verions of libmcrypt, or whatever comes after 2.4.8).  This adds a 
"blowfish-compat" mode which solves some endianness issues.

However, PHP still isn't compatible with Perl's Crypt::Blowfish, nor (I imagine) with 
any other software that uses Blowfish encryption.  Also, the 2.2.x and 2.4.x functions 
in PHP, when passed the same parameters, don't generate the same encrypted strings.

Here are links to three files: the test vectors from, test scripts using 2.2.x functions and one 
using 2.4.x functions, with and without long key handling.

All scripts generate some different results than the test vectors.  The closest to 
getting them all right, is the 2.4.x script that emulates Perl keys.  However, it 
still gives the "wrong" answer for one test case.

- Colin

Edit Bug report at:

PHP Development Mailing List <>
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]

Reply via email to