Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm currently doing research on cracking encrypted, compressed files (specifically: uif, zip, 7z, dmg). Looking at all the utilities out there, it seems the time it takes to crack something is greatly reduced when a better idea of password length/character set is known (this is obvious to me from prior experience in brute forcing/dictionary attacks). Is there a way to forensically analyze the encrypted compressed files themselves to get more information on the password, the hash it uses, etc in order to optimize cracking?

Theories I've thought of but need to know feasibility/tools needed: forensic markings in the assembler/binary, figuring out hashing mechanism to allow rainbow tables, etc.

share|improve this question

3 Answers 3

Any good encryption generates a uniform distribution of characters, making it look very close to randomness. Thus you cannot figure out what kind of crypto simply by looking at the ciphertext.

I guess the closest you could come to that is if crypto X produces output in 128byte increments and crypto Y produces 64byte blocks, then if your ciphertext is on a 64byte boundary that isn't also a 128byte boundary then it, then it has to be crypto Y. The problem is a lot of cryptos produce similarly sized blocks so you're guessing among many different algorithms.

share|improve this answer

No, there is no way (that I know of) to determine the password length, short of cracking the password itself.

(If there were a way to do that, it would be a flaw in the encryption scheme.)

share|improve this answer
2  
The point is that PKZIP encryption is very flawed and vulnerable to known plaintext attack. Bad crypto abound. e.g. see unix-ag.uni-kl.de/~conrad/krypto/pkcrack.html –  Bruno Rohée May 3 '11 at 8:07
1  
@Bruno: absolutely, PKZIP uses/used a custom stream cipher which can be attacked with only a dozen of known plaintext bytes, and cost about 2^38 (i.e. a few minutes). However, newer ZIP utilities tend to use AES instead, which is much more robust. –  Thomas Pornin May 3 '11 at 10:45
    
Is there any way of knowing if it's AES vs. PKZIP? Also, I have been using fcrackzip, are there any other tools that are more efficient at brute forcing? –  mrnap May 4 '11 at 21:45

https://code.google.com/p/pzapr/

This was run on a supercomputer cluster with 4,096 cores. Brute force speed was 172 passwords / second / core.

The ZIP file format specification provides metadata (unencrypted) that tells what type of encryption was used.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.