How to create the right Blowfish padding? I use the OpenSSL library for Blowfish encryption in ecb mode.
The message are encrypted, but with the wrong padding, because of it I have a problems with decryption. What am I doing wrong?

I checked with:

http://sladex.org/blowfish.js/

and java.

It should be:
Kl9SMj1A42I48uWYTeBuD9rERDGhuvbbp07+4QwPhtk=

I get it:
Kl9SMj1A42I48uWYTeBuD9rERDGhuvbbLUwFXarEOq39/f39

#include &lt;iostream&gt;
#include &lt;string&gt;
#include "Base64.h"
#include &lt;openssl/blowfish.h&gt;

int main()
{
    // blowfish key
    const char *key = "topsecret";
    const unsigned char* in = (const unsigned char*)"hello world how are you today";

    BF_KEY bfKey;
    BF_set_key(&amp;bfKey, strlen(key), (const unsigned char*)key);

    size_t InSize = strlen((char*)in) + 1;
    size_t OutSize = ((InSize + 7) / 8) * 8;

    unsigned char *out = (unsigned char *)malloc(OutSize);
    unsigned char *outnext = out;

    //Encryption
    while (InSize &gt;= 8) {
        BF_ecb_encrypt(in, outnext, &amp;bfKey, BF_ENCRYPT);
        in += 8;
        outnext += 8;
        InSize -= 8;
    }
    if (InSize &gt; 0) {  // Cope with non-octal length
        unsigned char buf8[8];
        memcpy(buf8, in, InSize);
        for (int i = InSize; i &lt; 8; i++) {
            buf8[i] = ((int)'0');
        }
        BF_ecb_encrypt(buf8, outnext, &amp;bfKey, BF_ENCRYPT);
    }

    std::cout &lt;&lt; Base64::base64_encode(out, strlen((char *)out)) &lt;&lt; std::endl;

    std::cin.get();

    return 0;
}


Base64:

http://pastebin.com/DvLt3MPg
I use the OpenSSL library for Blowfish encryption in ecb mode. [...] What am I doing wrong?


You're using ECB mode and no authentication.



But as for the question itself.

Your input length is 29+1 bytes, which should get padded to 32 bytes, which should be ceil(32/3*4) = ceil(42.67) = 43 characters when base64-encoded, plus one = to round up to four. The output from the site you linked to seems to be of that length, but the output from your code looks like 48 characters, or 36 bytes. Extra bytes appear to show up from somewhere.

The output is made using this call to base64_encode:

unsigned char *out = (unsigned char *)malloc(OutSize);
base64_encode(out, strlen((char *)out))


The length is determined with strlen. But is the data in the out buffer terminated with a zero byte? I don't see that terminator anywhere, so it may be that strlen and hence base64_encode read past the buffer. 
Check what the strlen output is, compared to OutSize. 

In any case, the output from the cipher might contain zero bytes too, so I don't think you should be using strlen here at all. 

Also, the padding you are using destroys the length of the plaintext. That is, foobar and foobar0 pad to the same string, foobar00 and there's no way to tell them apart. You may want to consider some other method of padding. (Basically, encode the length of the padding in the padding itself, which means you may need to pad a full block.)