From: Daniel Gustafsson <daniel@yesql.se>
To: Marco.Lebahn@kfw.de
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19335: the function encrypt does not work correct - ERROR: encrypt error: Key was too big
Date: Fri, 28 Nov 2025 12:07:54 +0100
Message-ID: <5448DF07-F573-4F90-8D71-C3F746C122D9@yesql.se> (raw)
In-Reply-To: <20251128103836.F0FA510BC47D@s979.loopia.se>
References: <19335-0ba21e6ccf61a219@postgresql.org>
<9BAD0CC4-5170-4976-AF06-30E3EC9F008C@yesql.se>
<20251128092235.E4AFD2C8BA6B@s899.loopia.se>
<0628D055-2B0C-4852-AE0A-1B60545CF4AB@yesql.se>
<20251128093111.648D47CEB0C@s934.loopia.se>
<A5101E78-4BD4-4F56-92E2-F80E49625666@yesql.se>
<20251128103836.F0FA510BC47D@s979.loopia.se>
> On 28 Nov 2025, at 11:38, <Marco.Lebahn@kfw.de> <Marco.Lebahn@kfw.de> wrote:
>
> It seems that < 16.11 does and not check if I use "bf" from legacy provider
postgres does not consider which providers are loaded at all, since we support
OpenSSL 1.1.1+ the code doesn't even know of the provider concept. Further,
pgcrypto in v16 hasn't been changed at all since January 2024. If 16.10 allows
blowfish and 16.11 doesn't then, as Tom suggested upthread, you need to look at
which OpenSSL pgcrypto.so is linked against and how they are configured.
> :~> openssl list -providers
> Providers:
> default
> name: OpenSSL Default Provider
> version: 3.2.3
> status: active
>
> :~> psql postgres
> psql (16.10)
> Type "help" for help.
>
> postgres=# SELECT encrypt('sdafgsdfgsdafgasdf', 'thelongkeyfoobar', 'bf');
> encrypt
> ----------------------------------------------------
> \x74a761b105fbc8f535f666e952e00018deb1349fbf27a87b
> (1 row)
The above pgcrypto is highly unlikely to run against the same OpenSSL instance
(lib + configuration) in that case, note this from the OpenSSL 3.0 changelog:
* Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2,
RC4, RC5, and DES to the legacy provider.
OpenSSL doesn't support blowfish without the legacy provider loaded. Your
16.10 is most likely linked against another version of OpenSSL, or at least
using another OpenSSL configuration/openssldir.
--
Daniel Gustafsson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: daniel@yesql.se, Marco.Lebahn@kfw.de, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19335: the function encrypt does not work correct - ERROR: encrypt error: Key was too big
In-Reply-To: <5448DF07-F573-4F90-8D71-C3F746C122D9@yesql.se>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox