unsafe use of /tmp files

There is an unsafe use of /tmp files in cryptcab:

if ((od = creat ("/tmp/.blowfish.key",0600)) == -1){

Note that creat(2) cannot protect against symlink attacks because it does not include the open(2) O_EXCL flag.

It also seems odd to hard code a filename here rather than use mkstemp(3) to generate a random filename and properly create the file (using O_EXCL to open(2)).