From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Marco.Lebahn@kfw.de
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19335: the function encrypt does not work correct - ERROR: encrypt error: Key was too big
Date: Fri, 28 Nov 2025 13:29:21 -0500
Message-ID: <505781.1764354561@sss.pgh.pa.us> (raw)
In-Reply-To: <5448DF07-F573-4F90-8D71-C3F746C122D9@yesql.se>
References: <19335-0ba21e6ccf61a219@postgresql.org>
<9BAD0CC4-5170-4976-AF06-30E3EC9F008C@yesql.se>
<20251128092235.E4AFD2C8BA6B@s899.loopia.se>
<0628D055-2B0C-4852-AE0A-1B60545CF4AB@yesql.se>
<20251128093111.648D47CEB0C@s934.loopia.se>
<A5101E78-4BD4-4F56-92E2-F80E49625666@yesql.se>
<20251128103836.F0FA510BC47D@s979.loopia.se>
<5448DF07-F573-4F90-8D71-C3F746C122D9@yesql.se>
Daniel Gustafsson <daniel@yesql.se> writes:
> On 28 Nov 2025, at 11:38, <Marco.Lebahn@kfw.de> <Marco.Lebahn@kfw.de> wrote:
>> It seems that < 16.11 does and not check if I use "bf" from legacy provider
> OpenSSL doesn't support blowfish without the legacy provider loaded. Your
> 16.10 is most likely linked against another version of OpenSSL, or at least
> using another OpenSSL configuration/openssldir.
It seems quite odd that this changed at a minor PG version update.
I wonder if there was an upgrade of the underlying platform at the
same time, or if the new version was built by a different packager.
I confirmed on a fresh Fedora installation (with OpenSSL 3.2.6)
that it works as Daniel described. Blowfish and other old ciphers
don't work with the out-of-the-box OpenSSL configuration, but if
you edit `openssl info -configdir`/openssl.cnf and uncomment the
lines that enable the legacy provider, it will work. (I found
I had to restart the PG server, too --- apparently we only absorb
that configuration at postmaster start. Didn't think to try
"pg_ctl reload"; perhaps that would have been enough.)
Of course the real bottom line here is you should be migrating
away from use of these ciphers. There's a reason they are
deprecated and intentionally made hard-to-reach.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, daniel@yesql.se, Marco.Lebahn@kfw.de, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19335: the function encrypt does not work correct - ERROR: encrypt error: Key was too big
In-Reply-To: <505781.1764354561@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox