Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I get the following error if I give a key that is greater than 64 hex caracters (64*4=256 bits).

enter image description here

According to this official document, blowfish is able to support key from 32 to 448 bits.

Variable key length: 32 bits to 448 bits

Is it possible to bypass this limitation? What's wrong?

The actual key size is big enough, but I would like to have the most security as possible.

Thanks,

share|improve this question
2  
You sure you want an iv of 0? –  Zoredache Dec 13 '12 at 16:39
    
It would be cryptographically more secure to use twofish or threefish instead of blowfish... –  Chris S Dec 13 '12 at 19:44
    
@ChrisS Thanks for your advice, I will take a look at those algorithms. –  Jonas Dec 14 '12 at 8:53
add comment

3 Answers

While the algorithm itself supports a variable key length of up to 448 bits, OpenSSL's implementation of it is limited to 256 bits. I found several pages referring to this limitation; this one has a nice table: http://etutorials.org/Programming/secure+programming/Chapter+5.+Symmetric+Encryption/5.18+Using+Variable+Key-Length+Ciphers+in+OpenSSL/

share|improve this answer
add comment

There is no meaningful cryptographic difference between a 256-bit and 448-bit symmetric key. Nobody sane is going to try to brute-force a 256-bit blowfish symmetric cipher.

This was written in 1999, but still holds true: https://www.schneier.com/crypto-gram-9902.html#snakeoil

share|improve this answer
add comment
up vote 1 down vote accepted

Actually, there is a tiny bug in the openssl program. It allows key of length up to 256 bits, but in fact, only the first 128 bits are used for the blowfish key. The only way to use a longer key is to write a program using the lib.

By using the -p option in the enc, we can verify that the key used is a 128 bits key :

echo toto | openssl enc -bf-cbc -K 000000000000000000000000000000000000000000000000000000 -iv 0 -a -p

Result :

salt=801D670000000000
key=00000000000000000000000000000000
iv =0000000000000000
5XAXlTvP0ZE=

I recently discoverd the security site of stackexchange and asked the same question. Brendan gave me the following answer.

Should I delete this question?

share|improve this answer
    
Jonas, I find that a really interesting and relevant answer, but is there a reference for this that you can point to, as well as telling us about it? It would definitely deserve an upvote if it was referenced! –  MadHatter Dec 14 '12 at 9:04
    
Thanks for the reference, have an upvote, and no, I think you should leave the question here. In my experience of SF, it's perfectly OK to ask a question that you later work out the answer to (most of us don't stop think about problems after we post them!) and it's OK to come back and post the answer you've found, to help others who might ask the question in future. I believe that you may be able to accept your own answer after a period of time, if you sincerely feel it's the best one, to prevent your accept rate from falling. In any case, you should accept an answer at some point. –  MadHatter Dec 14 '12 at 9:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.