[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <4A84DBA5-AE0D-4CD7-A241-F21AD7082535@damienotis.link>
Date: Wed, 26 Aug 2026 21:44:52 -0700
From: Damien Otis <damien@...ienotis.link>
To: john-users@...ts.openwall.com
Subject: need an ataxia mode
Hello users of john,
I have this zip archive I made with winrar with a simple text password because I was just gonna upload my bitlocker keys to my VPS before I flashed my mobo and lost the bitlocker keys there. I was trying to be sensible to not leak sensitive keys into a VM under the hypervisor of another, but I wish I’d just printed ‘em ‘cause somehow this very simple password doesn’t work.
The file was transferred to my server with filezilla via SFTP, and I’ve hashed the copies of this archive I have and they all match. I didn’t verify the copy from windows but I presume filezilla would transfer a zip file as binary. I have some files locked away in bitlocker that I can’t otherwise replace. Disk space is expensive. I may be a little paranoid these days but I had a laptop stolen in the era when auto login was just something we all did with our portables. Oh I tried y.key but apparently it doesn’t work from the restart-3 times windows recovery environment. Or I’m doing something else wrong idk
I have, among other things, ataxia, or issues with fine motor skills. I’m one of those people who will type extra letters or wrong letters if I’m not paying attention carefully or apathetic due to the context. So it’s possible I added a letter or two, held on shift for one too many letters (only the first letter is capitalized), swapped a few letters, or maaaybe typed a number instead of a letter in the top left home row.
I’ve emailed winrar regarding issues that might relate to the zip format and encryption. They told me that they use “standard” 256-bit AES encryption for their zip archives, and that in those cases the password is encoded in UTF-8. The archive doesn’t have the markers of the standard, poorly secured zip archive but I can’t exactly recall which encryption I picked.
The winrar team also told me that the standard unarchiving utilities on macOS and Linux are likely not recognizing the 256-bit AES format correctly, so they would always return an incorrect password result even if the password was right. So there’s some hope… but using the winrar on wine debian 13 trixie did not yield positive results.
Neither did a basic john crack at the password for the hash of the zip file I made with zip2john. I ran john with min and max password set to 8 and without any fancy parameters except forking. Once it got to the ascii incremental I shut it off, because I knew it was ridiculous to start with such a large character set.
I’ve been looking at some options, like john_mask="[?l?u0-6][?l?u0-6][?l0-6]”. I think it would be best to specify the specific zip has format to avoid doing unnecessary work on algorithms not likely to yield results. I should also enable openCL, but that requires nvidia datacenter drivers and debian is working right now.
Is there anybody here who’s got the insights on the options I should use? I want to be smart about this and go for the most likely options and eliminate the possibilities and expand if necessary. The previous run returned a line:
1 0:00:00:00 - Algorithm: PBKDF2-SHA1 256/256 AVX2 8x
I see 256. is AVX2 the specific instruction set for the standard sha 256? I’m not sure on the terminology here. Also, if I’m using openCL does the format change? I guess it wouldn’t be AVX2.
Any advice or insight would be appreciated!
— Damien wants their data back
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
