🚀 go-pugleaf

In <adamsd.715442992@crash> adamsd@crash.cts.com (Adams Douglas) writes:


> It's my understanding that the file-locking algorithm in Wordperfect 5.1
>is easily broken. Is this something that can be fixed or guarded against 
>(without actually doing something outside the program)? 

The only way to "fix" it is using an encryption program (meaning outside,
not as a patch or so).

>Why is it so
>easily crackable? Were they just lazy, or what?

It seems to be a combination of two factors. The basic encryption scheme
is just simple, this is probably a matter of choice. The indended purpose
will have been dayly use encryption, not spy proof. The major problem
of the WP encryption seems to be a bug. Due to the way the header of
a file is encrypted one can extract the password almost directly.

The used encryption method has to do with xoring with the password and
since the header contains known data the encrypted header leads to
the password.

>And, yes, although I'm curious how one _does_ crack it, I'm more interested
>in how to fix it - if it can be.

There are 1001+ tools to crack WP files. The best fix for know is using an
external program like PGP (available garbo etc). The best fix in time will
be WP 6.0 (currently only for OS/2 2.0 planned I believe) which might
contain RSA encryption they licenced from RSA.


Nico E. de Vries
_ _
O O  USENET nevries@cc.ruu.nl  FIDO 2:281/708.1  COMPUSERVE "soon" ???? 
 o   This text reflects MY opinions, not that of my employer BITECH.      
\_/  This text is supplied 'AS IS', no waranties of any kind apply.      
     Don't waste your time on complaining about my hopeless typostyle.

In article <adamsd.715442992@crash> adamsd@crash.cts.com (Adams Douglas) writes:
>[...] Wordperfect 5.1 is easily broken.

Yup.

> Is this something that can be fixed or guarded against 
>(without actually doing something outside the program)?

Nope -- not without massive re-code.

>Why is it so easily crackable?  Were they just lazy, or what?

If not lazy, they were like other beginners in crypto.  Everybody seems to
go through the same learning curve.  At each stage, you're convinced that
your algorithm is so complex no one will be able to crack it.  Once someone
does, it's back to the drawing board.  This is why it's strongly
recommended that a person break several cryptosystems before attempting to
design one of his/her own.

In article <adamsd.715442992@crash> adamsd@crash.cts.com (Adams Douglas) writes:

>[...] Wordperfect 5.1 is easily broken.
>Why is it so easily crackable?  Were they just lazy, or what?

Suppose they had used DES.  The same people who regularly forget that
they used their first name as their login password will forget that
they used the name of the file as the encryption key.  Now their
100 page annual report is completely lost, with no hope of ever
getting it back.

Suppose they use some nothing idiot encryption like rot-13.  Most
people in a given office probably don't know how to crack it, so it
provides reasonable security.  When the user forgets the key, however,
it *is* possible to find a way to recover the data.

Very few MIS departments would want to hand every secretary in the
company an unrecoverable encryption option in a word processor.
The damage it would inevitably do when the users forget their keys six months
from now would generally far outweigh the security benefits in the mean time.
A few people at a few companies may really need DES, and if they do
they can go out and get a third party encryption package.  

-don alvarez