3

I know that "legacy ZIP-crypto" is not secure and you can get at the contents of the file quite easily.

Now the question is, can you also get at the password (assume this is a very long, very high entropy password)?

A colleague has actually managed to use one of our "high security pass phrases" for encrypting a ZIP file and sending it out to a third-party e-mail system. Are other containers, using the same passphrase, secure, or could someone, who fetched that ZIP file, "extract" the passphrase from it and then move on to decrypt other, higher-security containers with it as well?

Improve this question

1 Answer 1

Reset to default
6

Maybe.

The legacy algorithm uses iterated CRC32 to derive its initial state from the password. As the original paper describing the attack (archive.org link) notes, the invertibility of the CRC32 hash function means that the password can be recovered with complexity 2((n-6)*8), so passwords of up to 16-18 characters should be reasonably recoverable.

However, because the cipher only maintains 12 bytes of internal state, if the actual password is longer than this, an attacker may instead find a 12- or 13-byte "equivalent password" that can decrypt other legacy-zip files, but is useless for decrypting files encrypted with other algorithms.

Improve this answer
2
  • How do I get the underlying encryption algorithm of a zip file? I mean whether ZipCrypto is using aes or that old algorithm?
    – user2284570
    Mar 25, 2020 at 19:19
  • It depends on which Zip program you're using.
    – Mark
    Mar 31, 2020 at 20:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .