bkcrack 1.7.1
Crack legacy zip encryption with Biham and Kocher's known plaintext attack.
|
Related publications, online resources and tools.
A known plaintext attack on the PKZIP stream cipher
Biham E., Kocher P.C. (1995) A known plaintext attack on the PKZIP stream cipher. In: Preneel B. (eds) Fast Software Encryption. FSE 1994. Lecture Notes in Computer Science, vol 1008. Springer, Berlin, Heidelberg. DOI
Describes a known plaintext attack on the PKZIP stream cipher. Requires 13 bytes of known plaintext: 8 for generating 2^38 candidates and 5 for filtering candidates.
There are several parts:
bkcrack is based on this paper.
ZIP Attacks with Reduced Known Plaintext
Stay M. (2002) ZIP Attacks with Reduced Known Plaintext. In: Matsui M. (eds) Fast Software Encryption. FSE 2001. Lecture Notes in Computer Science, vol 2355. Springer, Berlin, Heidelberg. DOI
Reviews Biham and Kocher attack. Suggests a small improvement to require 12 bytes instead of 13 bytes (not throwing away 6 known bits in Y7). Suggests using CRC-32 check bytes from several files as known plaintext.
Then, it presents other approaches. One is using 4 bytes of known plaintext to generate 2^63 candidates. The other uses a weakness in a random number generator.
An Improved Known Plaintext Attack on PKZIP Encryption Algorithm
Jeong K.C., Lee D.H., Han D. (2012) An Improved Known Plaintext Attack on PKZIP Encryption Algorithm. In: Kim H. (eds) Information Security and Cryptology. ICISC 2011. Lecture Notes in Computer Science, vol 7259. Springer, Berlin, Heidelberg. DOI
About speeding up the attack using known plaintext from several files. It assumes the very first bytes are known. However, the very first encrypted bytes are from the encryption header which starts with 10 or 11 random bytes. So, it does not seem practical unless the pseudo-random number generator used to fill the encryption header is broken.
Improved Forensic Recovery of PKZIP Stream Cipher Passwords
Coray, S., Coisel, I., Sanchez, I. (2019). Improved Forensic Recovery of PKZIP Stream Cipher Passwords. In Proceedings of the 5th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-359-9, pages 328-335. DOI
About finding the actual password, either using the internal keys or not. Does computations on the GPU with OpenCL.
Implemented in hashcat :
Applied Cryptanalysis: Breaking Ciphers in the Real World
Stamp, M., & Low, R. M. (2007). Applied cryptanalysis: breaking ciphers in the real world. John Wiley & Sons.
Contains a chapter about stream ciphers. A section is dedicated to PKZIP encryption and Biham and Kocher attack.
APPNOTE.TXT - .ZIP File Format Specification
Published by PKWARE, Inc. which developed the ZIP format.
RFC1951 - DEFLATE Compressed Data Format Specification
Deflate compression algorithm is often used in ZIP files.
Microsoft Docs - DosDateTimeToFileTime function
Microsoft documentation page describing the date and time format used in ZIP date and time fields.
Biham and Kocher attack implementation by Peter Conrad.
License: Postcardware
A Rust rewrite of bkcrack by Aloxaf. Added ZIP64 support long before bkcrack.
License: zlib
Password recovery tool. See Coray2019.
License: MIT
Password recovery tool.
License: GNU General Public License v2.0 (Almost, see LICENSE)
Tool and library for cracking legacy zip files by Marc Ferland. Implements bruteforce, dictionary and known plaintext attacks to recover the password.
License: GNU General Public License v3.0
A patched p7zip by Aloxaf. Supports ZIP file extraction using the internal keys with the following syntax:
7za e cipher.zip '-p[12345678_23456789_34567890]'
License: GNU Lesser General Public License v2.1 + unRAR restriction
Deflate disassembler to convert a deflate, zlib, or gzip stream into a readable form.
License: zlib
Python script telling which encryption method is used in a ZIP file.
License: CC0 / Public Domain