I have a file which has been encrypted with some unknown algorithm. Doing research on the file format, I stumbled across a website that claimed (without explaining why) that these files were encrypted with 32bit Blowfish. This website also speculates that the magic smoke is contained in a .iff file with a specific name.
It turns out that the .iff file is embedded in a plaintext portion of the encrypted file. I have clawed this out, and it hints at it being Blowfish.
The 4 byte header is "BLFS". The next int32 after that is 0x80. Then follows 16 bytes of random binary string (128 bits). Then, two more int32s... 0x75 and 0x01. Following that, 120 bytes of binary string (not 117?), and 4 nulls. The last bit I think is safe to assume as padding, as the parent file requires some weird byte-alignment scheme.
I have many examples of these encrypted files. The 128bit string changes, file to file. The 120byte string changes, file to file. BLFS, 0x80, 0x75, and 0x01 all remain constant.
I am a cryptography noob. The 120byte string is far too long to be a Blowfish key, which maxes out at 56 bytes. The 128bit string is a better bet (it has that nice round power-of-two number that the original implementor would have liked). I know that an algorithm like this would also require an iv, but aren't those short? In some cases, just a byte?
Is this iff file I've extracted the magic sauce, and is it the sort that I think it is? I'm not able to make sense of what I'm seeing, and I'm not sure what research I need to do next to accomplish that.
Apologies if this question isn't a fit for this SE, please comment and let me know that before closing.