john-users - How does cracking pkzip2 files work?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <YLiSlvCpQ3jkHTXJ@zurich>
Date: Thu, 3 Jun 2021 10:28:06 +0200
From: Matthias Braun <matthias@...lbytes.com>
To: john-users@...ts.openwall.com
Subject: How does cracking pkzip2 files work?

Hi,

I'd like to understand how JtR uses the output of zip2john to crack the password of an pkzip2 archive.

After reading the description of zip2john's output in the source file (https://github.com/openwall/john/blob/bleeding-jumbo/src/zip2john.c), this is my current assumption: Since the archive doesn't contain the hash of the password used for encrypting, per default, JtR tries a wordlist to decrypt the data stored at the DA position in zip2john's output, runs CRC32 on the result and compares that checksum with the checksum stored at the CR position.

But in the case of cracking the password for a large file, I'd expect decryption to take quite a while, making each password guess costly.

How does JtR crack pkzip2 archives?

Thanks!
Matthias

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.