Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I created an encrypted but forgot the password. When I attempted a pattern based brute force it said it had over a 100 trillion passwords to check. And to my knowledge that could take a few years. Based on this it may be possible to use a padding oracle attack. That being said, how would I go about doing a "padding oracle attack"? I could not find anything on google.

share|improve this question

2 Answers 2

A padding oracle attack is not helpful in cracking a 7zip archive. In a padding oracle attack the attacker must be able to decrypt arbitrary ciphertext, and the target must return a signal notifying the attacker that the padding of the arbitrary ciphertext is correct or not.

In the case of a 7zip archive where you do not know the password, you cannot decrypt the archive, so there is no way of knowing, if the padding is valid to begin with.

share|improve this answer
    
do you have any suggestions then? –  Timberwolf Mar 20 '13 at 21:10
    
@Timberwolf Programmers brute force. –  Rook Mar 20 '13 at 22:23

As @Rook says a padding oracle attack isn't appropriate to your circumstances, however some suggestions for you in retrieving your archive.

  • If you have common passwords or phrases create a dictionary of those and then run an attack based on modifications of those words
  • If you have any memory of the length of the password use that to constrain the attack
  • if this is sufficiently valuable to you, you could look at software which makes use of GPUs and/or multiple CPU cores to speed up the cracking process.

at the end of the day It'll largely depend on how much you can cut down the search space and how much power you can throw at it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.