0

If I encrypt a file using the old Unix/Linux crypt() function, how can it be decrypted or attacked?

I understand how a password file (for example) is attacked, you guess passwords, run them through crypt() and see if the result matches the entry in /etc/passwd (well, /etc/shadow on modern systems).

However, I don't see how you can do this with an encrypted file, you can't seriously guess the contents of the file and run that through the crypt() function to see if you get a match for the encrypted file.

1
  • 1
    Did you meant the old crypt utility? The crypt function isn't useful to encrypt data. – Gilles 'SO- stop being evil' Oct 4 '15 at 13:34
2

The usual way of cracking an encrypted file is trying different keys until you get a result which makes sense. How do you know you found such a result? Usually because you know the resulting file must have some kind of internal structure. For example, when you know the decrypted file is in an XML format, you would run every result through an XML validator. Or when you know the decrypted file has its own checksum somewhere, you would check if it matches. When you expect natural language text, you could check the letter frequency to be similar to natural language. On UNIX systems you have the tool file which can detect many common file formats. When it returns something, it might be a possible hit.

But when you have no idea at all what might be the content of the file, you have no way to tell if the garbage returned by applying the algorithm with a random key is in fact the garbage you are looking for.

2
  • OK, thanks, that's much as I thought. It means that, although the Unix crypt() function isn't very secure it would still be very difficult to crack my files because they contain fairly random data. It is human readable of course but it's not by any means text or structured in any particular way. – Chris Green Oct 5 '15 at 9:26
  • @ChrisGreen That depends on how random they are. When they are human readable, they might be vulnerable to a known plaintext attack (when the attacker knows that a specific string must occur somewhere in the file, they can exploit this to crack it much faster). – Philipp Oct 5 '15 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.