Re: Re: Mac port & endianness

On Mon, 13 Jun 2005 07:02:15 -0400, Nolan Eakins <[email protected]>  
wrote:
>
> I've had similar issues, but I don't have a big endian machine to test
> on though. I took a crack at it, but still didn't get it. I've been
> meaning to look at it again, but I've been busy w/ some other work at
> the moment. I'd be open to hearing any secrets that you uncover.
>

IIRC, the implementation of the Blowfish algorithm expects big-endian
integers as input, i.e., the "block" that you pass into the Encrypt and
Decrypt operations are intended to be 64bit, big-endian integers.

Now, Password Safe does the Wrong Thing(*) by feeding little-endian
integers into the Blowfish algorithm, without swapping the byte-order.
So instead of "7 6 5 4 3 2 1 0", Blowfish gets "4 5 6 7 0 1 2 3". So,
with respect to the algorithm, Password Safe swaps the byte order for
all input and output data.

To accomodate for this in a platform independent manner, you have to swap
the byteorder yourself, every time you pass data to or receive data from
the Blowfish engine.

E.g., in Passord Gorilla, the computation of H(RND) looks like

proc pwsafe::int::computeHRND {RND password} {
     set temp $RND
     append temp "\x00\x00"
     append temp $password
     set tempSalt [pwsafe::int::sha1isz $temp]

     set engine [iblowfish::ecb \#auto $tempSalt]
     set cipher [pwsafe::int::genderbender $RND]
     for {set i 0} {$i < 1000} {incr i} {
	set cipher [$engine encryptBlock $cipher]
     }
     itcl::delete object $engine

     set temp [pwsafe::int::genderbender $cipher]
     append temp "\x00\x00"
     return [pwsafe::int::sha1isz $temp 1]
}

where the "genderbender" operation swaps the byte order of every 32 bit
integer in the block.

I've tested this on big-endian machines.

Frank

(*) You might not want to call it "wrong," maybe just "obfuscated." It
certainly does not seem to be a security issue.

-- 
Frank Pilhofer, [email protected]


-------------------------------------------------------
This SF.Net email is sponsored by: NEC IT Guy Games.  How far can you shotput
a projector? How fast can you ride your desk chair down the office luge track?
If you want to score the big prize, get to know the little guy.  
Play to win an NEC 61" plasma display: http://www.necitguy.com/?r=20