Comment 4 for bug 695417

I had a chance to look through the blowfish.c code, it looks like there isn't a way to make the old key work with the new code, unless the key length checking is removed.

Looking through our implementation notes, a 72-character key was chosen because that was the number of iterations through the key string. The blowfish reference C implementation (http://www.schneier.com/blowfish-download.html) release notes mentions a 72-byte key, the C implementations by Bruce and others don't check the key length and will take any size key and use the first 72 bytes. I'm not sure if a key size greater than 448-bits is cryptographically significant.

Would it be possible to again support key sizes larger than 56-characters for backwards compatibility and compatibility with other C implementations? Or note in the documentation that key sizes greater than 448-bits are no longer supported?

On Dec 29, 2010, at 4:38 PM, Eric Chamberlain wrote:

> We don't really need a longer key, it's the key size we used and now have tens of thousands of database columns encrypted a key of that length.
>
> I haven't looked at the old code, is there something we could do to modify the key to get it to work with the new code?
>
> I was hoping for an easier solution than decrypting and re-encrypting the data.
>
>
> On Dec 29, 2010, at 4:23 PM, Dwayne Litzenberger wrote:
>
>> I don't think this is a bug in PyCrypto. Blowfish specifies a maximum
>> key size of 448 bits, so if your code is using longer keys, then you're
>> not really using Blowfish anymore, you're using PyCryptoBugFish.
>>
>> What are you doing that you need a key longer than 448 bits?
>>
>>
>> "Eric Chamberlain" <email address hidden> wrote:
>>
>>> Public bug reported:
>>>
>>> With version 2.0.1 our code works fine, but after upgrading to 2.3,
>>>
>>> blowfish = Blowfish.new(SECRET_KEY)
>>>
>>> generates the following error:
>>>
>>> ValueError: Maximum key size is 448 bits
>>>
>>> Our SECRET_KEYs are 74 ASCII characters long and we can't easily change
>>> them, given the amount of data encrypted with the keys.
>>>
>>> Is it possible to bring back the 2.0.1 behavior to support backwards
>>> compatability with keys of arbitrary length?
>>>
>>> ** Affects: pycrypto
>>> Importance: Undecided
>>> Status: New
>>>
>>> --
>>> You received this bug notification because you are subscribed to
>>> Python-
>>> Crypto.
>>> https://bugs.launchpad.net/bugs/695417
>>>
>>> Title:
>>> Blowfish breaks between versions 2.0.1 and 2.3
>>
>> --
>> Sent from my Android phone with K-9 Mail. Please excuse my brevity.
>>
>> --
>> You received this bug notification because you are a direct subscriber
>> of the bug.
>> https://bugs.launchpad.net/bugs/695417
>>
>> Title:
>> Blowfish breaks between versions 2.0.1 and 2.3
>>
>> Status in Python Cryptography Toolkit:
>> New
>>
>> Bug description:
>> With version 2.0.1 our code works fine, but after upgrading to 2.3,
>>
>> blowfish = Blowfish.new(SECRET_KEY)
>>
>> generates the following error:
>>
>> ValueError: Maximum key size is 448 bits
>>
>> Our SECRET_KEYs are 74 ASCII characters long and we can't easily change them, given the amount of data encrypted with the keys.
>>
>> Is it possible to bring back the 2.0.1 behavior to support backwards compatability with keys of arbitrary length?
>>
>> To unsubscribe from this bug, go to:
>> https://bugs.launchpad.net/pycrypto/+bug/695417/+subscribe
>