🚀 go-pugleaf

..and then suddenly one "ai@iol.ie (Astronomy Ireland)" writ:

=> What's the best newsgroup for this query?
=> 
=> How secure is PKZIP's scramble option?
=> Is it easy to crack or one of those 'advanced' techniques?
=> 
=> I never saved the documentation, where can I find a full PKZIP package? 
=> Thanks.

	Here's the relevant page from PKZIP 2.04g manual on encryption.
	It has a table showing estimated hacking times based upon
	technology at the time of writing (I guess this was about 1992)
	and assumes 10,000 tries per second.
	=================================================

	Quote:--	

How secure is PKZIP encryption?
There are many factors to consider when using PKZIP encryption.  
There are also several levels and implications to consider.

The first level of security is physical.  Who has access to the .ZIP
file?  You need to be aware of who might be able to get to sensitive
data located on your machine, on your floppies, or on your personal
network drive.

The potential hazards of using data encryption cannot be stressed
strongly enough.  Make certain that you will be able to recall what
was used for the encryption key.  Also be certain that all people who
need to be able to access this data have agreed upon how the
encryption will be performed.

It does happen that people encrypt very important data, and then go on
"vacation" to a distant land, or meet their untimely demise, without
first passing on the encryption key.  In these sorts of eventualities
the data is gone.  So consider well before you encrypt or allow the
encryption of information.  If this information is so vital to you
that you feel you must encrypt it, consider what the loss of it would
mean to you.

All forms of encryption, including the one used by PKZIP, are open to
"brute force" attacks.  This form of attack is simply the trying of
many passwords until you find one that works.

In order to help you protect your data from this sort of attack we
present figures on how long a brute force attack, using a computer,
would take.  The scenario we present here assumes that your encrypted
.ZIP file is being assaulted by a program which is designed
specifically to do this.

An encryption key may contain any valid ASCII character, not just A-Z
in upper and lower case and punctuation marks.  However, most people
will just use the latter.  The following table is indexed by the
complexity of the password.  Across the top is the range of characters
used.  The simplest assumes that only lower case letters from a to z
were used.  The next column assumes that all printable characters were
used (a to z in upper and lower case, punctuation, brackets, etc.).
The last column assumes a password containing the complete range of
ASCII characters.

The vertical index is the length of the password used.  This impacts
the strength of the password greatly.  Think of it as a combination
lock.  A combination lock with only two numbers would be much easier
to break than one with three or four numbers.

We recommend that if you need a truly secure encrypted file, use an
encryption key of at least six characters.

The last assumption made is about the speed of the attacking program.
For the purposes of this table, we assume that 10,000 possible keys
are being attempted per second.

                        Password "Hacking" Time

      Key    26 characters  96 characters    256 characters
     Length     (a-z)             (a-z,A-Z,etc)       (All ASCII)

        3    2 seconds            1 minute        27 minutes
	
        4    1 minute              2.35 hours      4 days

        5    19 minutes          9 days             3 years

        6    8.6 hours             2 years            891 years

        7    9 days                 238 years        2283 centuries

        8    241 days             228 centuries   584,546 cent.

        9    17 years             21,945 cent.     149,643,989 cent.

       10    447 years           2,106,744         38,308,861,211
                                         centuries         centuries


Choose the complexity that you feel meets your needs, but keep in mind
all that has been mentioned about losing and forgetting passwords.

These figures represent the state of technology today.  PKWARE Inc.
cannot predict future technologies which may allow faster attempts at
decryption of a .ZIP file.

Note that the above figures do not include the time needed to actually
try all valid passwords.  This would increase the time by several
hundred percent, dependent upon the length of the file.

	Unquote.
_________________________________________________________________
 The only certainty about British weather is that it's uncertain
_________________________________________________________________
<beija-flor>, London, England, European Union
e-mail seja@feliz.netkonect.co.uk