kimci86 / bkcrack

Crack legacy zip encryption with Biham and Kocher's known plaintext attack.
zlib License
1.68k stars 163 forks source link

Cracking ZIP containing Deflate 3pg by part of file #128

Closed Tideus closed 4 months ago

Tideus commented 4 months ago

Hello, I'm trying to crack a ZIP file containing a 3gp video I have a copy of the original file in 3gp format

The 3gp file inside were compressed using Deflate (Normal Compression).

bkcrack.exe -C secret.zip -c car.3gp -P original.zip -p car.3gp The whole file was hacked successfully. bkcrack 1.7.0 - 2024-05-26 [19:50:57] Z reduction using 112303 bytes of known plaintext 17.4 % (19556 / 112303) [19:50:59] Attack on 206 Z values at index 93576 Keys: 38e907e1 95c5f60f 753d204e 100.0 % (206 / 206) Found a solution. Stopping. [19:50:59] Keys 38e907e1 95c5f60f 753d204e

Next, I want to check how hacking works on a part of the file. I cut out a part of the file (32 bytes) and put it in plaintext. Then I archived it using the same method as the encrypted archive HEX

Executed the command bkcrack.exe -C secret.zip -c car.3gp -P plaintext.zip -p plaintext.3gp

The keys were not found. Although the length is sufficient (25 bytes) bkcrack 1.7.0 - 2024-05-26 [19:44:01] Z reduction using 25 bytes of known plaintext 100.0 % (25 / 25) [19:50:03] Could not find the keys.

What am I doing wrong? Do you have any advice?

kimci86 commented 4 months ago

Hi, this is expected. The attack requires a piece of data before and after encryption. The data being compressed in the encrypted archive in your case, the corresponding plain data you provide must be compressed data as well, compressed in the exact same way. When you use the entire file (and same compression tool and settings), you get compressed data that matches exactly the compression of the encrypted version, so the attack works. However when you use a small fraction of the file, the compressed data does not match. In general, compressing a prefix of a file does not give a prefix of the compressed file. It is difficult to guess compressed data when you know only a little part. Let me know if that helps.

Tideus commented 4 months ago

Thanks! I was hoping to restore files based on a part of the known text by first compressing it. Now I understand that this is not enough.