Other Directory Sites: SeekWonder | Directory Owners Forum
The following archive was created by hippie-mail 7.98617-22 on Sat Apr 10 1999 - 01:15:21
jwashbur@whittman-hart.com
Wed, 14 Oct 1998 09:25:26 -0500
The known text attack by Eli Biham and Paul C. Kocher mentioned in:
http://www.uneedus.com/~dave/public/pkzip-crack.txt
is devastatingly effective on PKZip archives made with version 1.10.
>From the APPNOTE.TXT:
general purpose bit flag: (2 bytes)
Bit 0: If set, indicates that the file is encrypted.
(For Method 6 - Imploding)
Bit 1: If the compression method used was type 6,
Imploding, then this bit, if set, indicates
an 8K sliding dictionary was used. If clear,
then a 4K sliding dictionary was used.
Bit 2: If the compression method used was type 6,
Imploding, then this bit, if set, indicates
an 3 Shannon-Fano trees were used to encode the
sliding dictionary output. If clear, then 2
Shannon-Fano trees were used.
What is not mentioned, but easily determined by examining the compressed
data streams
with a hex editor, is that the Shannon-Fano trees used are static. There
are 3 possible trees.
The actual tree used can be determined by bits 1 and 2. These trees insure
that the first
15-23 bytes of the compressed stream are known. The tree, coupled with the
High word of
the CRC in the IV, provide a sufficiently large sample of known compressed
data to
employ the Kocher/Biham attack on the 96-bit internal state of the PKZip
encryption engine.
The above is only valid for version 1.1 PKZip files.
In Liberty,
John Washburn
The following archive was created by hippie-mail 7.98617-22 on Sat Apr 10 1999 - 01:15:21