Passwords Confidentiality in Windows-based Client Applications

Question

A password protected (.xls) file created in Microsoft Office can be opened with Open Office.

How does Open Office recognize the Password created in MS Excel? Isn't this a security concern?

Similar thing happens between WinZip, WinRAR and 7-Zip.

Regards, Kamlesh

Answer 1

So long as the various applications use the same password algorithm to create the password hash then there is no reason they shouldn't all work. The password itself is generally not stored in the file.

Answer 2

Presumably each of these applications has asked you for the password. If not then that would be a security concern.

The password is stored in the file in an encrypted form. The method of converting the plain text to the encrypted (or hashed) form is known and implemented in each of the applications. They then compare the encrypted strings and if they match let you open the file.

It should be very difficult, if not impossible, to take the encrpyted string and convert it back into the plain text password - so there is no security risk.

Answer 3

Generally speaking office encryption is easily breakable. There are several programs available to compute a password that matches the hash and therefor opens the file. Even though the computed password and actual password may not match, the hash is the same.