bkcrack 1.7.1
Crack legacy zip encryption with Biham and Kocher's known plaintext attack.
Resources

Related publications, online resources and tools.

Research papers

  • A known plaintext attack on the PKZIP stream cipher

    Biham E., Kocher P.C. (1995) A known plaintext attack on the PKZIP stream cipher. In: Preneel B. (eds) Fast Software Encryption. FSE 1994. Lecture Notes in Computer Science, vol 1008. Springer, Berlin, Heidelberg. DOI

    Describes a known plaintext attack on the PKZIP stream cipher. Requires 13 bytes of known plaintext: 8 for generating 2^38 candidates and 5 for filtering candidates.

    There are several parts:

    • Optionally, using additional contiguous known plaintext to reduce the number of candidates.
    • Finding the password internal representation.
    • Recovering the password.

    bkcrack is based on this paper.

  • ZIP Attacks with Reduced Known Plaintext

    Stay M. (2002) ZIP Attacks with Reduced Known Plaintext. In: Matsui M. (eds) Fast Software Encryption. FSE 2001. Lecture Notes in Computer Science, vol 2355. Springer, Berlin, Heidelberg. DOI

    Reviews Biham and Kocher attack. Suggests a small improvement to require 12 bytes instead of 13 bytes (not throwing away 6 known bits in Y7). Suggests using CRC-32 check bytes from several files as known plaintext.

    Then, it presents other approaches. One is using 4 bytes of known plaintext to generate 2^63 candidates. The other uses a weakness in a random number generator.

  • An Improved Known Plaintext Attack on PKZIP Encryption Algorithm

    Jeong K.C., Lee D.H., Han D. (2012) An Improved Known Plaintext Attack on PKZIP Encryption Algorithm. In: Kim H. (eds) Information Security and Cryptology. ICISC 2011. Lecture Notes in Computer Science, vol 7259. Springer, Berlin, Heidelberg. DOI

    About speeding up the attack using known plaintext from several files. It assumes the very first bytes are known. However, the very first encrypted bytes are from the encryption header which starts with 10 or 11 random bytes. So, it does not seem practical unless the pseudo-random number generator used to fill the encryption header is broken.

  • Improved Forensic Recovery of PKZIP Stream Cipher Passwords

    Coray, S., Coisel, I., Sanchez, I. (2019). Improved Forensic Recovery of PKZIP Stream Cipher Passwords. In Proceedings of the 5th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-359-9, pages 328-335. DOI

    About finding the actual password, either using the internal keys or not. Does computations on the GPU with OpenCL.

    Implemented in hashcat :

Books

ZIP specification

Tools

Cracking internal keys

  • PkCrack

    Biham and Kocher attack implementation by Peter Conrad.

    License: Postcardware

  • Aloxaf/rbkcrack

    A Rust rewrite of bkcrack by Aloxaf. Added ZIP64 support long before bkcrack.

    License: zlib

Password recovery

  • hashcat

    Password recovery tool. See Coray2019.

    License: MIT

  • John the Ripper

    Password recovery tool.

    License: GNU General Public License v2.0 (Almost, see LICENSE)

  • mferland/libzc

    Tool and library for cracking legacy zip files by Marc Ferland. Implements bruteforce, dictionary and known plaintext attacks to recover the password.

    License: GNU General Public License v3.0

Other tools

  • Aloxaf/p7zip

    A patched p7zip by Aloxaf. Supports ZIP file extraction using the internal keys with the following syntax:

    7za e cipher.zip '-p[12345678_23456789_34567890]'
    

    License: GNU Lesser General Public License v2.1 + unRAR restriction

  • madler/infgen

    Deflate disassembler to convert a deflate, zlib, or gzip stream into a readable form.

    License: zlib

  • hannob/zipeinfo

    Python script telling which encryption method is used in a ZIP file.

    License: CC0 / Public Domain