🚀 go-pugleaf

Now that the 31 Dec 92 deadline for the PKware contest ("crack this
zip-encrypted file") has passed, I'd like to know what the password really
was.  I did some initial hacks based on looking at passwords that passed
the CRC test in the header, then looked for things that they had in
common, hypothesizing that if they <did> have something in common, that
would give a clue as to what the password looked like.

So I threw lots of passwords at it, and came up with some interesting
commonalities.  For example, I fed it all five-letter passwords drawn
from printable characters (my Sparcstation was busy while I was in Japan
for a couple of weeks!), and came up with these most common 4-letter
substrings from the 5-letter passwords that passed the CRC.  There were
74,472 passwords that worked, including (for example):

	4Hut@
	7dhdA
	5$.~W
	+}h]y
	((w~~

To give you a flavor of the more usual kind of things, here are all of the
substrings that were common to exactly 4 of the semi-successful passwords:

        &\"r (\'j .x\` >\`\ H\`B O\"\ \",\ \"2\ \"4\ \"P\ \"XK \"b\ \'#{
        \'T1 \'\\ \'f\ \`.\ \`3, \`4M \`5\ \`92 \`X\ \`g\ b\`\ d\'\ g\"\
        oi\' zu\' }f\'

Notice that there are many backslashes and quotes of one kind or another.

Now here's everything above 4 occurrences of common substrings in
CRC-passing passwords:

   5 )\'k
   5 C\"Q
   5 _\`\
   7 \`Y\
  14 \'\`
  20 \"\`
  22 \'\"
  22 \`\"
  24 \"\'
  27 \`\`
  30 \"\"
  31 \`\'
  33 \'\'

There's a dramatic peak of things with backslash and one or the other kind
of quotes.  This is kind of interesting, because these are characters hard
to pass through the shell to a program (like pkzip).

I didn't have time to follow up on this and try to extend it to 7-letter
passwords composed of these characters and a few others, but I'm quite
curious now to find out if the <real> password had a preponderance of this
stuff (backslashes and quotes), or whether my whole search strategy was
out to lunch.  Could somebody from PKware comment?
-- 
	Jim Gillogly
	Monday, 16 Afteryule S.R. 1993, 16:52