bkcrack: Resources

bkcrack 1.8.1 Crack legacy zip encryption with Biham and Kocher's known plaintext attack.

Resources

Related publications, online resources and tools.

# Research papers

- A known plaintext attack on the PKZIP stream cipher

  Biham E., Kocher P.C. (1995) A known plaintext attack on the PKZIP stream cipher. In: Preneel B. (eds) Fast Software Encryption. FSE 1994. Lecture Notes in Computer Science, vol 1008. Springer, Berlin, Heidelberg. DOI

  Describes a known plaintext attack on the PKZIP stream cipher. Requires 13 bytes of known plaintext: 8 for generating 2^38 candidates and 5 for filtering candidates.

  There are several parts:

  - Optionally, using additional contiguous known plaintext to reduce the number of candidates.
  - Finding the password internal representation.
  - Recovering the password.

  bkcrack is based on this paper.

- ZIP Attacks with Reduced Known Plaintext

  Stay M. (2002) ZIP Attacks with Reduced Known Plaintext. In: Matsui M. (eds) Fast Software Encryption. FSE 2001. Lecture Notes in Computer Science, vol 2355. Springer, Berlin, Heidelberg. DOI

  Reviews Biham and Kocher attack. Suggests a small improvement to require 12 bytes instead of 13 bytes (not throwing away 6 known bits in Y7). Suggests using CRC-32 check bytes from several files as known plaintext.

  Then, it presents other approaches. One is using 4 bytes of known plaintext to generate 2^63 candidates. The other uses a weakness in a random number generator.

- An Improved Known Plaintext Attack on PKZIP Encryption Algorithm

  Jeong K.C., Lee D.H., Han D. (2012) An Improved Known Plaintext Attack on PKZIP Encryption Algorithm. In: Kim H. (eds) Information Security and Cryptology. ICISC 2011. Lecture Notes in Computer Science, vol 7259. Springer, Berlin, Heidelberg. DOI

  About speeding up the attack using known plaintext from several files. It assumes the very first bytes are known. However, the very first encrypted bytes are from the encryption header which starts with 10 or 11 random bytes. So, it does not seem practical unless the pseudo-random number generator used to fill the encryption header is broken.

- Improved Forensic Recovery of PKZIP Stream Cipher Passwords

  Coray, S., Coisel, I., Sanchez, I. (2019). Improved Forensic Recovery of PKZIP Stream Cipher Passwords. In Proceedings of the 5th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-359-9, pages 328-335. DOI

  About finding the actual password, either using the internal keys or not. Does computations on the GPU with OpenCL.

  Implemented in hashcat :

  - Attack on the password without plaintext: https://github.com/hashcat/hashcat/pull/1962
  - Recovering the password from the internal keys: https://github.com/hashcat/hashcat/pull/2032

# Books

- Applied Cryptanalysis: Breaking Ciphers in the Real World

  Stamp, M., & Low, R. M. (2007). Applied cryptanalysis: breaking ciphers in the real world. John Wiley & Sons.

  Contains a chapter about stream ciphers. A section is dedicated to PKZIP encryption and Biham and Kocher attack.

  - Editor's page
  - Author's page
  - Author's slides on PKZIP attack

# ZIP specification

- APPNOTE.TXT - .ZIP File Format Specification

  Published by PKWARE, Inc. which developed the ZIP format.

- RFC1951 - DEFLATE Compressed Data Format Specification

  Deflate compression algorithm is often used in ZIP files.

- Microsoft Docs - DosDateTimeToFileTime function

  Microsoft documentation page describing the date and time format used in ZIP date and time fields.

# Tools

## Cracking internal keys

- PkCrack

  Biham and Kocher attack implementation by Peter Conrad.

  License: Postcardware

- Aloxaf/rbkcrack

  A Rust rewrite of bkcrack by Aloxaf. Added ZIP64 support long before bkcrack.

  License: zlib

## Password recovery

- hashcat

  Password recovery tool. See Coray2019.

  License: MIT

- John the Ripper

  Password recovery tool.

  License: GNU General Public License v2.0 (Almost, see LICENSE)

- mferland/libzc

  Tool and library for cracking legacy zip files by Marc Ferland. Implements bruteforce, dictionary and known plaintext attacks to recover the password.

  License: GNU General Public License v3.0

## Other tools

- Aloxaf/p7zip

  A patched p7zip by Aloxaf. Supports ZIP file extraction using the internal keys with the following syntax:

      7za e cipher.zip '-p[12345678_23456789_34567890]'

  License: GNU Lesser General Public License v2.1 + unRAR restriction

- madler/infgen

  Deflate disassembler to convert a deflate, zlib, or gzip stream into a readable form.

  License: zlib

- madler/spoof

  Modify a message to have a desired CRC signature.

  It can be used to reconstruct a plaintext file if only a few bytes are unknown using the CRC-32 checksum.

  License: zlib

- hannob/zipeinfo

  Python script telling which encryption method is used in a ZIP file.

  License: 0BSD

- pmqs/zipdetails

  Perl script displaying details about the internal structure of ZIP files.

  License: same as Perl - GNU General Public License or "Artistic License"