Can't create (AS3) compatible blowfish string in Ruby - ruby

Question

I'm using Ruby to try and encrypt a string which will be stored in a database and read/decrypted by a Flash/Actionscript app.
The app uses this blowfish implementation.
I have tried both the openssl and crypt/blowfish methods of creating a compatible string. Neither match each other and neither matches what the Flash app expects.
Where do I start in terms of getting this to work?
irb(main):001:0> require 'openssl'
=> true
irb(main):002:0> require 'crypt/blowfish'
=> true
irb(main):007:0> require 'base64'
=> true
irb(main):003:0> key = "foo"
=> "foo"
irb(main):004:0> plain = "some string"
=> "some string"
irb(main):005:0> blowfish = Crypt::Blowfish.new(key)
=>
irb(main):006:0> enc = blowfish.encrypt_block(plain)
=> "\xF5\xAFB\x12=\xB9\xDB\f"
irb(main):008:0> Base64.encode64(enc)
=> "9a9CEj252ww=\n"
# Now, openssl version
irb(main):009:0> cipher = OpenSSL::Cipher::Cipher.new('bf-cbc').send(:encrypt)
=> #<OpenSSL::Cipher::Cipher:0x00000000f26430>
irb(main):010:0> cipher.key = Digest::SHA256.digest(key)
=> ",&\xB4kh\xFF\xC6\x8F\xF9\x9BE<\x1D0A4\x13B-pd\x83\xBF\xA0\xF9\x8A^\x88bf\xE7\xAE"
irb(main):011:0> enc = cipher.update(plain) << cipher.final
=> "m<\xDB\xC1B\x02p\xB0\xD6\xD0\xA4\xE8XyY\x99"
irb(main):012:0> Base64.encode64(enc)
=> "bTzbwUICcLDW0KToWHlZmQ==\n"
EDIT
Here's what we're doing in AS3 (with the blowfish code mentioned above):
import com.lassieadventurestudio.Blowfish;
import fl.controls.Button;
import fl.controls.TextInput;
import flash.events.MouseEvent;
var $key:String = "foo";
BTN_Submit.label = "Encrypt";
BTN_Submit.addEventListener(MouseEvent.CLICK, onSubmit);
function onSubmit(event:MouseEvent):void
{
trace("INP_Pass.text, ", INP_Pass.text);
var $encryption:String = Blowfish.encrypt(INP_Pass.text, $key);
TXT_Output.text = $encryption;
}
BTN_Decrypt.label = "Decrypt";
BTN_Decrypt.addEventListener(MouseEvent.CLICK, decrypt);
function decrypt(event:MouseEvent):void
{
TXT_Output2.text = Blowfish.decrypt(TXT_Output.text, $key);
}

Answer 1

The problem is that both ways you tried do use CBC mode, but the AS3 example you linked to is using ECB mode.
You can achieve the same using this:
cipher = OpenSSL::Cipher.new('bf-ecb')
cipher.encrypt
cipher.key = key
enc = cipher.update(plain) << cipher.final
Be warned though, this is not a good encryption scheme at all for several reasons (ECB, Blowfish key length, password used directly as key...), as was written in the article, it will only hold off prying eyes, but this will not pose an obstacle to someone who is dedicated about it.
Edit:
I looked at the AS3 implementation, but unfortunately I wasn't able to reproduce the example results given there. But I am confident that the Blowfish implementation from the blog is bad, you shouldn't use it. There they take plain passwords for keys, and to make things worse, they Base64-decode them first to get raw bytes, thereby effectively decreasing the already bad entropy again by a factor of 3/4.
Ruby OpenSSL's Blowfish implementation takes 16 byte keys, so you won't be lucky in reproducing the results with shorter keys. I would recommend to you to do the following:
Use AES instead of Blowfish. While Blowfish has never been "broken", its effective security of 56 bits can be brute-forced.
Don't use passwords as keys. Use cryptographically secure random bytes. An easy way to do this in Ruby for example is:
key = cipher.random_key
You may want to find something similar in AS3.
Don't use ECB mode. Use CBC mode or, if available with your OpenSSL version (requires >=1.0.0), even better, use CTR mode.
You might want to look at the Cipher docs for more advice on achieving something that may be considered secure.