1

I looked for an answer for this question over here, yet all I could find were about cracking the password. So let's say I'm using PHP to generate a cryptographically secure random password:

echo "Password: " . bin2hex(openssl_random_pseudo_bytes(32, true));

Password: 7c81c0426b1b636c505420776e8c080032da122e6ec462d837a87dab3bded596

Having this password, it seems like it would be easier to guess the hash itself and decrypt the files manually (so the attacker wouldn't have to waste time on hashing the password everytime to check if it is correct).

How hard will it be to hack the rar/zip, without hacking the password itself?

Improve this question
3
  • 2
    Possible duplicate of How long it will take to crack a RAR password?
    – Sjoerd
    Commented Nov 30, 2016 at 7:55
  • @Sjoerd I'm not talking about cracking a password, I don't care about it. I'm looking for an answer about the files themselves. Cracking the password is not the only way to decrypt the files, right?
    – Vlad Gincher
    Commented Nov 30, 2016 at 8:00
  • 5
    The problem with trying to decrypt cyphertext without a key is that you have no idea when you have succeeded. That's why cracking passwords makes more sense.
    – schroeder ♦
    Commented Nov 30, 2016 at 8:26

1 Answer 1

Reset to default
3

From an information theory point of view, your password contains 32×8=256 bits of information. If your encryption key is also 256 bits long, you would need in average 2^255 tries to brute-force the key or the password: they would be of the same strength. If however your encryption key or the hash of your password is 128 bits long, it would need in average 2^127 tries to brute-force them: it would then be a waste of time to brute-force the password, guessing the encryption key would be astronomically faster, even with a less efficient algorithm.

In practice you would need the adapt the brute-forcing algorithm to check if the decryption of the archive succeeded or could succeed. This would use heuristics and possibly the checksums commonly found in archive formats.

Also, in practice, you don't event try to brute-force 2^128 combinations. You try the side door.

Improve this answer
4
  • So how does an archive hashed the password? And even if the password and the hash have the same length, it would be way faster to brute force the hash itself. And my question is exactly about the side doors - how someone can decrypt an archive without even trying to crack the password or the hash, but doing something else.
    – Vlad Gincher
    Commented Nov 30, 2016 at 8:53
  • If the password and the hash have the same length, the difference in time to crack them is negligible. If their was another way to decrypt than those I have described, the cryptographic algorithm would be broken and that would make the news. As far as I know, AES is not broken.
    – A. Hersean
    Commented Nov 30, 2016 at 9:00
  • So you are saying that having an unguessable password makes the rar file basicly unhackable? Also, hashing takes time. Usually a lot of it. So an attacker would prefer to guess the hash, so he won't be needing to hash it. If he would try to guess the password, he would need to hash each guess and waste time.
    – Vlad Gincher
    Commented Nov 30, 2016 at 9:04
  • 2
    Brute-force algorithms can be optimized to the problem at hand. However brute-forcing remains brute-forcing and you'll always have at least 2^127 operations to compute to have half a chance to crack it. That's already too much. And yes having an unguessable password make the archive unhackable, that's the point of cryptography.
    – A. Hersean
    Commented Nov 30, 2016 at 9:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .