Description: ------------ Using test vectors from http://www.schneier.com/blowfish.html, this implementation does not generate expected values. One could also consider the results between the MCrypt implementation and the pure PHP, as this setup can use either. Test script: --------------- # # NOTE: Assume hex2bin and bin2hex functions # exist that convert hexadecimal strings # (base16) to/from binary strings (base256) # $B=new Crypt_Blowfish(hex2bin('0123456789ABCDEF')) echo bin2hex($B->encrypt('1111111111111111')) Expected result: ---------------- 61F9C3802281B096 Actual result: -------------- 2E38367FA01A330E

Never created a patch file before, so I just post the fixed code here. The only changes were the addititions of a floating modulus of 2^32 operation after the addition of the S0 and S1 parts and after the addition of the S3 parts as per the blowfish specification found at http://www.schneier.com/paper-blowfish-fse.html. Changes were made to the _encipher() and _decipher() methods of the Crypt_Blowfish_PHP class. The server being used for this bug is 64-bit. I have no idea, but wonder if this issue is specific to 64-bit platforms. /** * Enciphers a single 64-bit block * * @param int &$Xl * @param int &$Xr * @access protected */ function _encipher(&$Xl, &$Xr) { if ($Xl < 0) { $Xl += 4294967296; } if ($Xr < 0) { $Xr += 4294967296; } for ($i = 0; $i < 16; $i++) { $temp = $Xl ^ $this->_P[$i]; if ($temp < 0) { $temp += 4294967296; } $Xl = fmod(((fmod(($this->_S[0][($temp >> 24) & 255] + $this->_S[1][($temp >> 16) & 255] ),4294967296) ^ $this->_S[2][($temp >> 8) & 255] ) + $this->_S[3][$temp & 255] ),4294967296) ^ $Xr; $Xr = $temp; } $Xr = $this->_binxor($Xl, $this->_P[16]); $Xl = $this->_binxor($temp, $this->_P[17]); } /** * Deciphers a single 64-bit block * * @param int &$Xl * @param int &$Xr * @access protected */ function _decipher(&$Xl, &$Xr) { if ($Xl < 0) { $Xl += 4294967296; } if ($Xr < 0) { $Xr += 4294967296; } for ($i = 17; $i > 1; $i--) { $temp = $Xl ^ $this->_P[$i]; if ($temp < 0) { $temp += 4294967296; } $Xl = fmod(((fmod(($this->_S[0][($temp >> 24) & 255] + $this->_S[1][($temp >> 16) & 255] ),4294967296) ^ $this->_S[2][($temp >> 8) & 255] ) + $this->_S[3][$temp & 255] ),4294967296) ^ $Xr; $Xr = $temp; } $Xr = $this->_binxor($Xl, $this->_P[1]); $Xl = $this->_binxor($temp, $this->_P[0]); }

Thank you for taking the time to report a problem with the package. Unfortunately you are not using a current version of the package -- the problem might already be fixed. Please download a new version from http://pear.php.net/packages.php If you are able to reproduce the bug with one of the latest versions, please change the package version on this bug report to the version you tested and change the status back to "Open". Again, thank you for your continued support of PEAR. Thank you for taking the time to report a problem with the package. Unfortunately you are not using a current version of the package -- the problem might already be fixed. Please download a new version from http://pear.php.net/packages.php If you are able to reproduce the bug with one of the latest versions, please change the package version on this bug report to the version you tested and change the status back to "Open". Again, thank you for your continued support of PEAR.