165 lines
5.5 KiB
Plaintext
165 lines
5.5 KiB
Plaintext
Article 357 of sci.crypt:
|
||
Xref: vpnet comp.compression:174 sci.crypt:357
|
||
Path: vpnet!tellab5!laidbak!ism.isc.com!ispd-newsserver!rpi!crdgw1!uunet!maverick.ksu.ksu.edu!matt.ku.edu!parsons
|
||
From: parsons@matt.ksu.ksu.edu (Ghost in the Machine)
|
||
Newsgroups: comp.compression,sci.crypt
|
||
Subject: Re: Security of PKZIP's encryption
|
||
Message-ID: <1991Apr2.070810.10812@maverick.ksu.ksu.edu>
|
||
Date: 2 Apr 91 07:08:10 GMT
|
||
References: <1991Mar26.150049.20882@athena.cs.uga.edu>
|
||
Sender: news@maverick.ksu.ksu.edu (The News Guru)
|
||
Organization: Kansas State University
|
||
Lines: 135
|
||
|
||
is@athena.cs.uga.edu (Bob Stearns) writes:
|
||
|
||
>While I commonly recommend PKZIP (tm) for saving space on a hard disk, I have
|
||
>been asked how strong its encryption (-spassword) option is. I have no way of
|
||
>testing this and wonder if anyone out there in net land has investigated it.
|
||
>If you have investigated the actual code and can explain the general algorithm
|
||
>I can form my own opinion of its strength.
|
||
|
||
Here's what I found floating around on my roomates computer in the
|
||
PKzip archive file. This should help you to pass judgement on the security
|
||
of the password encryption.
|
||
|
||
DISCLAIMER: This is part of the application notes for PKZIP. Much
|
||
has been deleted about the actual compression algorithm, and only the
|
||
relevent part about password encryption remains.
|
||
|
||
|
||
Decryption
|
||
----------
|
||
|
||
The encryption used in PKZIP was generously supplied by Roger
|
||
Schlafly. PKWARE is grateful to Mr. Schlafly for his expert
|
||
help and advice in the field of data encryption.
|
||
|
||
PKZIP encrypts the compressed data stream. Encrypted files must
|
||
be decrypted before they can be extracted.
|
||
|
||
Each encrypted file has an extra 12 bytes stored at the start of
|
||
the data area defining the encryption header for that file. The
|
||
encryption header is originally set to random values, and then
|
||
itself encrypted, using 3, 32-bit keys. The key values are
|
||
initialized using the supplied encryption password. After each byte
|
||
is encrypted, the keys are then updated using psuedo-random number
|
||
generation techniques in combination with the same CRC-32 algorithm
|
||
used in PKZIP and described elsewhere in this document.
|
||
|
||
The following is the basic steps required to decrypt a file:
|
||
|
||
1) Initialize the three 32-bit keys with the password.
|
||
2) Read and decrypt the 12-byte encryption header, further
|
||
initializing the encryption keys.
|
||
3) Read and decrypt the compressed data stream using the
|
||
encryption keys.
|
||
|
||
|
||
Step 1 - Initializing the encryption keys
|
||
-----------------------------------------
|
||
|
||
Key(0) <- 305419896
|
||
Key(1) <- 591751049
|
||
Key(2) <- 878082192
|
||
|
||
loop for i <- 0 to length(password)-1
|
||
update_keys(password(i))
|
||
end loop
|
||
|
||
|
||
Where update_keys() is defined as:
|
||
|
||
|
||
update_keys(char):
|
||
Key(0) <- crc32(key(0),char)
|
||
Key(1) <- Key(1) + (Key(0) & 000000ffH)
|
||
Key(1) <- Key(1) * 134775813 + 1
|
||
Key(2) <- crc32(key(2),key(1) >> 24)
|
||
end update_keys
|
||
|
||
|
||
Where crc32(old_crc,char) is a routine that given a CRC value and a
|
||
character, returns an updated CRC value after applying the CRC-32
|
||
algorithm described elsewhere in this document.
|
||
|
||
|
||
Step 2 - Decrypting the encryption header
|
||
-----------------------------------------
|
||
|
||
The purpose of this step is to further initialize the encryption
|
||
keys, based on random data, to render a plaintext attack on the
|
||
data ineffective.
|
||
|
||
|
||
Read the 12-byte encryption header into Buffer, in locations
|
||
Buffer(0) thru Buffer(11).
|
||
|
||
loop for i <- 0 to 11
|
||
C <- buffer(i) ^ decrypt_byte()
|
||
update_keys(C)
|
||
buffer(i) <- C
|
||
end loop
|
||
|
||
|
||
Where decrypt_byte() is defined as:
|
||
|
||
|
||
unsigned char decrypt_byte()
|
||
local unsigned short temp
|
||
temp <- Key(2) | 2
|
||
decrypt_byte <- (temp * (temp ^ 1)) >> 8
|
||
end decrypt_byte
|
||
|
||
|
||
After the header is decrypted, the last two bytes in Buffer
|
||
should be the high-order word of the CRC for the file being
|
||
decrypted, stored in Intel low-byte/high-byte order. This can
|
||
be used to test if the password supplied is correct or not.
|
||
|
||
|
||
Step 3 - Decrypting the compressed data stream
|
||
----------------------------------------------
|
||
|
||
The compressed data stream can be decrypted as follows:
|
||
|
||
|
||
loop until done
|
||
read a charcter into C
|
||
Temp <- C ^ decrypt_byte()
|
||
update_keys(temp)
|
||
output Temp
|
||
end loop
|
||
|
||
|
||
In addition to the above mentioned contributors to PKZIP and PKUNZIP,
|
||
I would like to extend special thanks to Robert Mahoney for suggesting
|
||
the extension .ZIP for this software.
|
||
|
||
|
||
References:
|
||
|
||
Storer, James A. "Data Compression, Methods and Theory",
|
||
Computer Science Press, 1988
|
||
|
||
Held, Gilbert "Data Compression, Techniques and Applications,
|
||
Hardware and Software Considerations"
|
||
John Wiley & Sons, 1987
|
||
|
||
|
||
|
||
|
||
X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X
|
||
Another file downloaded from: The NIRVANAnet(tm) Seven
|
||
|
||
& the Temple of the Screaming Electron Taipan Enigma 510/935-5845
|
||
Burn This Flag Zardoz 408/363-9766
|
||
realitycheck Poindexter Fortran 510/527-1662
|
||
Lies Unlimited Mick Freen 801/278-2699
|
||
The New Dork Sublime Biffnix 415/864-DORK
|
||
The Shrine Rif Raf 206/794-6674
|
||
Planet Mirth Simon Jester 510/786-6560
|
||
|
||
"Raw Data for Raw Nerves"
|
||
X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X
|