--- a/sys/crypto/blowfish/bf_skey.c
+++ b/sys/crypto/blowfish/bf_skey.c
@@ -79,24 +79,30 @@
 
 	if (len > ((BF_ROUNDS + 2) * 4))
 		len = (BF_ROUNDS + 2) * 4;
+	if (len < 1)
+		len = 0;			/* degenerate: no key material */
 
 	d = data;
 	end= &(data[len]);
 	for (i = 0; i < BF_ROUNDS + 2; i++) {
-		ri = *(d++);
-		if (d >= end) d = data;
-
-		ri <<= 8;
-		ri |= *(d++);
-		if (d >= end) d = data;
-
-		ri <<= 8;
-		ri |= *(d++);
-		if (d >= end) d = data;
-
-		ri <<= 8;
-		ri |= *(d++);
-		if (d >= end) d = data;
+		if (len == 0) {
+			ri = 0;			/* skip P[] key mixing */
+		} else {
+			ri = *(d++);
+			if (d >= end) d = data;
+
+			ri <<= 8;
+			ri |= *(d++);
+			if (d >= end) d = data;
+
+			ri <<= 8;
+			ri |= *(d++);
+			if (d >= end) d = data;
+
+			ri <<= 8;
+			ri |= *(d++);
+			if (d >= end) d = data;
+		}
 
 		p[i] ^= ri;
 	}