"enc -bf-cfb" Command Summary

Blowfish Cipher Tutorials - Herong's Tutorial Examples - Version 1.21, by Dr. Herong Yang

Blowfish Cipher Tutorials - Herong's Tutorial Examples

∟OpenSSL "enc -bf-cfb" for Blowfish/CFB Encryption

∟"enc -bf-cfb" Command Summary

A quick summary is provided to list major features of the OpenSSL 'enc -bf-cfb' command. Blowfish algorithm in CFB operation mode with a random salt and PKCS#5 padding, or Blowfish/CFB/Salted/PKCS5Padding, is the recommended way to use Blowfish in CFB mode.

As a summary, we should remember the following about the OpenSSL "enc -bf-cfb" command:

OpenSSL "enc -bf-cfb" command allows us to run Blowfish algorithm in CFB (Cipher FeedBack) operation mode.

CFB (Cipher FeedBack) operation mode does not encrypt the plaintext block directly. It encrypts the previous ciphertext block, then XOR the result with the plaintext block to give the ciphertext. In other words, the previous ciphertext block is fed back to encryption algorithm and only use plaintext to XOR the result.

CFB (Cipher FeedBack) operation mode uses the IV value as the "previous" ciphertext block for the first block operation.

OpenSSL allows us to run cipher operations in 3 ways: Literal Key, Salted Key and Random Salt.

"Literal Key" means the secret key and the IV are specified literally using "-K" and "-iv" options.

The "-K value" option takes a 16-byte secret key in hex digits. If too short, 0x00 will be padded. If too long, extra bytes will be truncated.
The "-iv value" option takes a 8-byte IV value in hex digits. If too short, 0x00 will be padded. If too long, extra bytes will be truncated.

"Salted Key" means the secret key and the IV are derived from a passphrase and a salt given in "-pass" and "-S" options.

The "-pass pass:value" option takes passphrase string of any number of characters.
The "-S value" option takes a 8-byte salt in hex digits. If too short, 0x00 will be padded. If too long, extra bytes will be truncated.
The salt key generation algorithm takes the passphrase and the salt, runs MD5 hash function repeatedly to generate the secret key and the IV.
2 header blocks are prepended to the ciphtertext: The first block is the header name of "Salted__". The second block is the header value to record the 8-byte salt.

"Random Key" means the secret key and the IV are derived from a passphrase and a random salt using "-pass" and "-salt" options.

The "-pass pass:value" option takes passphrase string of any number of characters.
The "-salt" option turns on the random salt flag.
The salt key generation algorithm takes the passphrase and the salt, runs MD5 hash function repeatedly to generate the secret key and the IV.
2 header blocks are prepended to the ciphtertext: The first block is the header name of "Salted__". The second block is the header value to record the 8-byte salt.

OpenSSL allows us to pad plaintext with the standard PKCS#5 padding algorithm, which uses an integer byte as the padding byte with value equal to the number of bytes to be padded.

With all options mentioned above, we have many choices to run Blowfish CFB mode encryption. But the recommended way is to:

Select a Passphrase and send it over to the receiver in secure way.
Run OpenSSL "enc -bf-cfb" with Random Key with PKCS#5 padding on the plaintext file.
Send the ciphertext over to the receiver and tell her/him.
Tell her/him that the data is encrypted with Blowfish algorithm in CFB operation mode with a random salt and PKCS#5 padding, or Blowfish/CFB/Salted/PKCS5Padding.

Note that some of these points are not discussed in this chapter directly. But they are covered in the OpenSSL "enc -bf-ecb" command chapter.

Last update: 2015.

Table of Contents

About This Book

Blowfish Cipher Algorithm

Perl Crypt::Blowfish Module

Perl Crypt::ECB Perl Module

Perl Crypt::CBC Module

Perl Crypt::CFB Perl Module

OpenSSL "enc -bf-ecb" for Blowfish/ECB Encryption

OpenSSL "enc -bf-cbc" for Blowfish/CBC Encryption

►OpenSSL "enc -bf-cfb" for Blowfish/CFB Encryption