🚀 go-pugleaf

ai@iol.ie (Astronomy Ireland) wrote:

>What's the best newsgroup for this query?
>
>How secure is PKZIP's scramble option?
>Is it easy to crack or one of those 'advanced' techniques?
>
>I never saved the documentation, where can I find a full PKZIP package? 
>
>Thanks.
>
I am not sure what you mean by scramble but if you mean the password
protect feature then I know a little about it. There is a set of
software about which cracks pkzip passwords. Depending on the original
pasword and if you know anything about the password, decides how long
the typical crack takes ( also the speed of your PC ( I only know of a
pc version )) they quote that if the password is 10 characters long
and consists of alpha characters then the crack can take 5 hours.

I tried it on a know 8 character numeric only password and it solved
it in about 5 minutes. (on a pentium 60) 


 
 _______  ______ ________ ______ ______
|   _   \| _____|__    __| _____|    _  \
|  |_)   | ____|   |  |  | ____||   |_) /
|    ___/|______|  |__|  |______|___|\___\
|___|Peter@pejes.demon.co.uk

In article <428g6r$49b@barnacle.iol.ie>, ai@iol.ie (Astronomy Ireland) wrote:

[Snip]

> I never saved the documentation, where can I find a full PKZIP package? 

PKZ204G.EXE is the current full distribution archive, containing all the
bits and docs for PKZIP/PKUNZIP/etc. I think its here on IOL.

--Gerard Lardner.

On 2 Sep 1995 02:40:27 GMT, Astronomy Ireland wrote:
> How secure is PKZIP's scramble option?
> Is it easy to crack or one of those 'advanced' techniques?

It is not at all secure. Zipcrack tries exhaustive (I assume) searches of
the password space and manages to get through most zips I've tried it on
overnight, on a relatively humble 100MHz 486.

pete
-- 
Peter Fenelon - Research Associate - High Integrity Systems Engineering Group,
Dep't of Computer Science, University of York, York, YO1 5DD (+44 1904 433388)
Mail: pete@cs.york.ac.uk & Homepage on: http://dcpu1.cs.york.ac.uk:6666/~pete/

..and then suddenly one "ai@iol.ie (Astronomy Ireland)" writ:

=> What's the best newsgroup for this query?
=> 
=> How secure is PKZIP's scramble option?
=> Is it easy to crack or one of those 'advanced' techniques?
=> 
=> I never saved the documentation, where can I find a full PKZIP package? 
=> Thanks.

	Here's the relevant page from PKZIP 2.04g manual on encryption.
	It has a table showing estimated hacking times based upon
	technology at the time of writing (I guess this was about 1992)
	and assumes 10,000 tries per second.
	=================================================

	Quote:--	

How secure is PKZIP encryption?
There are many factors to consider when using PKZIP encryption.  
There are also several levels and implications to consider.

The first level of security is physical.  Who has access to the .ZIP
file?  You need to be aware of who might be able to get to sensitive
data located on your machine, on your floppies, or on your personal
network drive.

The potential hazards of using data encryption cannot be stressed
strongly enough.  Make certain that you will be able to recall what
was used for the encryption key.  Also be certain that all people who
need to be able to access this data have agreed upon how the
encryption will be performed.

It does happen that people encrypt very important data, and then go on
"vacation" to a distant land, or meet their untimely demise, without
first passing on the encryption key.  In these sorts of eventualities
the data is gone.  So consider well before you encrypt or allow the
encryption of information.  If this information is so vital to you
that you feel you must encrypt it, consider what the loss of it would
mean to you.

All forms of encryption, including the one used by PKZIP, are open to
"brute force" attacks.  This form of attack is simply the trying of
many passwords until you find one that works.

In order to help you protect your data from this sort of attack we
present figures on how long a brute force attack, using a computer,
would take.  The scenario we present here assumes that your encrypted
.ZIP file is being assaulted by a program which is designed
specifically to do this.

An encryption key may contain any valid ASCII character, not just A-Z
in upper and lower case and punctuation marks.  However, most people
will just use the latter.  The following table is indexed by the
complexity of the password.  Across the top is the range of characters
used.  The simplest assumes that only lower case letters from a to z
were used.  The next column assumes that all printable characters were
used (a to z in upper and lower case, punctuation, brackets, etc.).
The last column assumes a password containing the complete range of
ASCII characters.

The vertical index is the length of the password used.  This impacts
the strength of the password greatly.  Think of it as a combination
lock.  A combination lock with only two numbers would be much easier
to break than one with three or four numbers.

We recommend that if you need a truly secure encrypted file, use an
encryption key of at least six characters.

The last assumption made is about the speed of the attacking program.
For the purposes of this table, we assume that 10,000 possible keys
are being attempted per second.

                        Password "Hacking" Time

      Key    26 characters  96 characters    256 characters
     Length     (a-z)             (a-z,A-Z,etc)       (All ASCII)

        3    2 seconds            1 minute        27 minutes
	
        4    1 minute              2.35 hours      4 days

        5    19 minutes          9 days             3 years

        6    8.6 hours             2 years            891 years

        7    9 days                 238 years        2283 centuries

        8    241 days             228 centuries   584,546 cent.

        9    17 years             21,945 cent.     149,643,989 cent.

       10    447 years           2,106,744         38,308,861,211
                                         centuries         centuries


Choose the complexity that you feel meets your needs, but keep in mind
all that has been mentioned about losing and forgetting passwords.

These figures represent the state of technology today.  PKWARE Inc.
cannot predict future technologies which may allow faster attempts at
decryption of a .ZIP file.

Note that the above figures do not include the time needed to actually
try all valid passwords.  This would increase the time by several
hundred percent, dependent upon the length of the file.

	Unquote.
_________________________________________________________________
 The only certainty about British weather is that it's uncertain
_________________________________________________________________
<beija-flor>, London, England, European Union
e-mail seja@feliz.netkonect.co.uk

ai@iol.ie (Astronomy Ireland) wrote:

>What's the best newsgroup for this query?

>How secure is PKZIP's scramble option?
>Is it easy to crack or one of those 'advanced' techniques?

>I never saved the documentation, where can I find a full PKZIP package? 

>Thanks.

An Archie search to archie.doc.ic.ac.uk turned up the following sites,
among others, for ftp: 

It looks like the smaller files are just the zipping and/or unzipping
utilities.  I think the pkzip204g.exe (actually should be pk204g.exe,
202574 bytes) is the "full" package, which is shareware and costs
about $40U.S.  There are also some files that seem to be security
utilities or encryption capable near the bottom -- but I know nothing
about these.  

NO WARRANTY

Host ftp.edvz.uni-linz.ac.at

    Location: /pub/msdos/utils/cruncher
           FILE -rwxr-xr-x      11739  24-Aug-1995 03:31:10
pkzipm.zip

Host micros.hensa.ac.uk

    Location: /micros/ibmpc/dos/f/f413
           FILE -rw-r--r--      11741  24-Jul-1995 09:10:34
pkzipm.zip

Host ftp.latrobe.edu.au

    Location: /pub/msdos/zip
           FILE -r--r--r--      11739  21-Jul-1995 20:06:58
pkzipm.zip

Host ousrvr.oulu.fi

    Location: /pub/msdos/tools
           FILE -rw-r--r--      42552  03-Sep-1995 03:16:14  pkzip.exe

Host math.amu.edu.pl

    Location: /pub/chemia
           FILE -rw-r--r--      42166  03-Sep-1995 03:15:34  pkzip.exe

Host lut.fi

    Location: /pub/msdos
           FILE -rw-rw-r--      42166  03-Sep-1995 03:15:06  pkzip.exe

Host ftp.vse.cz

    Location: /pub/novell/netwire/techfile
           FILE -r--r--r--      42552  24-Aug-1995 03:42:13  pkzip.exe

Host ftp.kfunigraz.ac.at

    Location: /edvz/info-systems/win-dos
           FILE -rw-rw-r--      42166  24-Aug-1995 03:29:42  pkzip.exe

Host ftp.sunet.se

    Location: /pub/wais/freeware/windows
           FILE -r--r--r--      31488  18-Aug-1995 04:24:17  pkzip.exe
    Location: /uploads/newZip
           FILE -rw-------      35934  18-Aug-1995 04:24:17  pkzip.exe

Host alf.uib.no

    Location: /pc/sharewre/arkiv
           FILE -rw-r--r--      42166  18-Aug-1995 04:11:10  pkzip.exe

Host ugle.unit.no

    Location: /pub/bibsys/pakkeprogram
           FILE -rw-r--r--      42166  18-Aug-1995 04:03:29  pkzip.exe

Host ftp.virginia.edu

    Location: /pub/pc
           FILE -rw-r--r--      32880  11-Aug-1995 04:35:22  pkzip.exe
    Location: /public_access/notlob
           FILE -rw-rw-rw-      42166  11-Aug-1995 04:35:22  pkzip.exe

Host ftp.cs.umn.edu

    Location: /dept/users/karnik/cricket/bin
           FILE -rwxr-xr-x      24411  11-Aug-1995 04:18:33  pkzip.exe

Host dorm.rutgers.edu

    Location: /pub/DOS_Uncompress
           FILE -rw-r--r--      42166  10-Aug-1995 04:00:59  pkzip.exe

Host ftp.cs.unc.edu

    Location: /pub/users/wheeler
           FILE -rw-r--r--     202574  10-Aug-1995 03:11:30  pkzip.exe

Host bode.ee.ualberta.ca

    Location: /pub/dos/starter
           FILE -rw-r--r--      34296  05-Aug-1995 03:03:32  pkzip.exe

Host extro.ucc.su.oz.au

    Location: /pub/inet-apps/win3
           FILE -rw-r--r--      42166  04-Aug-1995 03:13:13  pkzip.exe

Host ftp.technion.ac.il

    Location: /pub/unsupported/vms/cerritos/pc/util
           FILE -rw-r--r--      42166  01-Aug-1995 03:18:40  pkzip.exe

Host ftp.std.com

    Location: /customers/vendors/DSPdev/demos/pc
           FILE -r-xr-xr-x      34296  01-Aug-1995 03:13:49  pkzip.exe
    Location: /customers/vendors/Intec/DNLOAD
           FILE -rw-r--r--      42475  01-Aug-1995 03:13:49  pkzip.exe
    Location: /gopherdir/vendors/.customers/nonprofits/freelance
           FILE -rw-r--r--     202574  01-Aug-1995 03:13:49  pkzip.exe

Host sw-eng.falls-church.va.us

    Location: /public/AdaIC/testing/piwg/piwg_11_92/piwg
           FILE -r--rw-r--      31342  01-Aug-1995 03:13:08  pkzip.exe

Host ajpo.sei.cmu.edu

    Location: /public/piwg/piwg_11_92/piwg
           FILE -rw-r--r--      31342  31-Jul-1995 03:12:12  pkzip.exe

Host ftp.essex.ac.uk

    Location: /pub/biology/tools
           FILE -rw-rwxr-x      42632  24-Jul-1995 09:21:47  pkzip.exe

Host ftp.univ-lille1.fr

    Location: /pub/pc/dos/compacteurs
           FILE -rw-rw-r--      23528  21-Jul-1995 20:54:14  pkzip.exe

Host ftp.loria.fr

    Location: /pub/textes/obi/customers/nonprofits/freelance
           FILE -r--r--r--     202574  21-Jul-1995 20:36:37  pkzip.exe
    Location: /pub/textes/obi/nonprofits/freelance
           FILE -r--r--r--     202574  21-Jul-1995 20:36:37  pkzip.exe

Host ftp.3com.com

    Location: /pub
           FILE -rw-r-----      34296  21-Jul-1995 20:23:50  pkzip.exe

Host ftp.cecer.army.mil

    Location: /isle/PCModSim
           FILE -rw-r--r--      42166  21-Jul-1995 20:22:43  pkzip.exe


Host ftp.tex.ac.uk

    Location: /ctan/tex-archive/tools
      DIRECTORY drwxr-xr-x        512  24-Jul-1995 09:17:48  pkzip
    Location: /ctan/tex-archive/tools/zip
      DIRECTORY drwxrwxr-x        512  24-Jul-1995 09:17:48  pkzip

Host ftp.loria.fr

    Location: /pub/unix/tex/ctan/tools
      DIRECTORY drwxr-xr-x        512  21-Jul-1995 20:36:37  pkzip
    Location: /pub/unix/tex/ctan/tools/zip
      DIRECTORY drwxr-xr-x        512  21-Jul-1995 20:36:37  pkzip

Host ftp.sunet.se

    Location: /pub/text-processing/TeX/tools/pkzip
           FILE -r--r--r--     202574  18-Aug-1995 04:24:17
pkzip204g.exe

Host ftp.jussieu.fr

    Location: /pub4/TeX/CTAN/tools/pkzip
           FILE -r--r--r--     202574  30-Jul-1995 03:05:04
pkzip204g.exe

Host ftp.tex.ac.uk

    Location: /ctan/tex-archive/tools/pkzip
           FILE -r--r--r--     202574  24-Jul-1995 09:17:48
pkzip204g.exe

Host ftp.loria.fr

    Location: /pub/unix/tex/ctan/tools/pkzip
           FILE -r--r--r--     202574  21-Jul-1995 20:36:37
pkzip204g.exe


ensa.ac.uk

    Location: /micros/ibmpc/dos/g/g038
           FILE -rw-r--r--     206248  24-Jul-1995 09:10:34  pkzip.zip

Host sunsite.doc.ic.ac.uk

    Location:
/media/literary/collections/e-serials/archive/alphabetic/c/cisnews/92/Apr
           FILE -r--r--r--       3741  24-Jul-1995 09:01:07  PKZIP for
IBM-PCs.gz
    Location:
/media/literary/collections/e-serials/archive/alphabetic/c/cisnews/93/Mar
           FILE -r--r--r--        987  24-Jul-1995 09:01:07  PKZIP
Version 2.04e.gz

Host ftp.sunet.se

    Location: /pub/security/docs/crypt/ripem.msu.edu
           FILE -r--r--r--      74855  18-Aug-1995 04:24:17
kocher-pkzip-attack.ps.gz

Host isdec.vc.cvut.cz

    Location:
/pub/security/unimi/certs/DFN-CERT/docs/crypt/ripem.msu.edu
           FILE -r--r--r--      74855  07-Aug-1995 04:41:29
kocher-pkzip-attack.ps.gz

Host scss3.cl.msu.edu

    Location: /pub/crypt/docs
           FILE -rw-r--r--      74855  04-Aug-1995 03:33:56
kocher-pkzip-attack.ps.gz
           FILE -rw-r--r--      26222  04-Aug-1995 03:33:56
kocher-pkzip-attack.txt

Host dorm.rutgers.edu

    Location: /pub/DOS_Uncompress/Manuals
           FILE -rw-r--r--     140355  10-Aug-1995 04:00:59  pkzip.doc

Host ftp.std.com

    Location: /customers/vendors/DSPdev/demos/pc
           FILE -r--r--r--       2039  01-Aug-1995 03:13:49  pkzip.doc

Host neptune.ethz.ch

    Location: /pub/Oberon/Windows
           FILE -rw-rw-r--     202574  10-Aug-1995 03:49:07
pkzip204.exe

Host nic.switch.ch

    Location: /mirror/Oberon/Windows
           FILE -rw-rw-r--     202574  10-Aug-1995 03:38:55
pkzip204.exe

Host hubcap.clemson.edu

    Location: /pub/pc_shareware/dos/Archive
      DIRECTORY drwxr-xr-x        512  04-Aug-1995 03:38:05  Pkzips

Host ftp.denet.dk

    Location: /pub/security/CIAC
           FILE -r--r--r--       5068  31-Aug-1995 03:44:24
c-27.ciac-PKZIP-virus-alert
    Location: /pub/security/CIAC/c-fy92
           FILE -r--r--r--       5068  31-Aug-1995 03:44:24
c-27.ciac-PKZIP-virus-alert

Host ftp.sunet.se

    Location: /pub/security/csir/ciac/bulletin/c-fy92
           FILE -r--r--r--       5068  18-Aug-1995 04:24:17
c-27.ciac-PKZIP-virus-alert

Host isdec.vc.cvut.cz

    Location: /pub/security/CIAC-advisories
           FILE -r--r--r--       5068  07-Aug-1995 04:41:29
c-27.ciac-PKZIP-virus-alert
    Location: /pub/security/CIAC-advisories/c-fy92
           FILE -r--r--r--       5068  07-Aug-1995 04:41:29
c-27.ciac-PKZIP-virus-alert
    Location: /pub/security/denet/CIAC
           FILE -r--r--r--       5068  07-Aug-1995 04:41:29
c-27.ciac-PKZIP-virus-alert
    Location: /pub/security/denet/CIAC/c-fy92
           FILE -r--r--r--       5068  07-Aug-1995 04:41:29
c-27.ciac-PKZIP-virus-alert

Host plaza.aarnet.edu.au

    Location: /pub/ciac/ciacdoc/c-fy92
           FILE -r--r--r--       5068  04-Aug-1995 03:53:54
c-27.ciac-PKZIP-virus-alert

Host ftp.net.ohio-state.edu

    Location: /pub/security/ciac/bulletin/c-fy92
           FILE -r--r--r--       5068  04-Aug-1995 03:45:33
c-27.ciac-PKZIP-virus-alert

Host extro.ucc.su.oz.au

    Location: /pub/sun-patches/sert/doc/CIAC
           FILE -r--r--r--       5068  04-Aug-1995 03:13:13
c-27.ciac-PKZIP-virus-alert

Host ftp.sunet.se

    Location: /pub/security/docs/crypt/ripem.msu.edu
           FILE -r--r--r--       8470  18-Aug-1995 04:24:17
kocher-pkzip-attack.txt.gz

Host isdec.vc.cvut.cz

    Location:
/pub/security/unimi/certs/DFN-CERT/docs/crypt/ripem.msu.edu
           FILE -r--r--r--       8470  07-Aug-1995 04:41:29
kocher-pkzip-attack.txt.gz

Host ftp.univie.ac.at

    Location:
/security/crypt/ftp.dsi.unimi.it/ftp.ox.ac.uk/cryptanalysis
           FILE -r--r--r--      74360  24-Aug-1995 03:13:14
pkzip.ps.gz
    Location:
/security/crypt/mirrors/ftp.dsi.unimi.it/ftp.ox.ac.uk/cryptanalysis
           FILE -r--r--r--      74360  24-Aug-1995 03:13:14
pkzip.ps.gz
    Location:
/systems/unix/security/crypt/ftp.dsi.unimi.it/ftp.ox.ac.uk/cryptanalysis
           FILE -r--r--r--      74360  24-Aug-1995 03:13:14
pkzip.ps.gz
    Location:
/systems/unix/security/crypt/mirrors/ftp.dsi.unimi.it/ftp.ox.ac.uk/cryptanalysis
           FILE -r--r--r--      74360  24-Aug-1995 03:13:14
pkzip.ps.gz

Host isdec.vc.cvut.cz

    Location: /pub/security/unimi/crypt/ftp.ox.ac.uk/cryptanalysis
           FILE -r--r--r--      74360  07-Aug-1995 04:41:29
pkzip.ps.gz

__
Penn
..