2

I found an old .rar file on my computer but I couldn't remember the password exactly. I had a rough idea of what it was, so I wrote a program using 7ziplib in c# to brute force a bunch of permutations.

After a few thousand it found a match. When I open the file in 7zip using the password I found, it opens but displays no files. When I try to open it in Winrar, it says corrupted archive or invalid password.

7ziplib reports the uncompressed file size as -1.

I ran the same brute force program for another zip in the same folder which had a similar but not identical password, and the same behaviour is exhibited.

There are other rar files in the same folder that are not password protected, which open fine.

Is there any algorithmic explanation for this? Could it be that I've found a password that gets past one stage of the password check but not another? Or is the archive corrupted?

The format is reported as Rar4 if that helps, which google says uses AES-128 but wikipedia states doesn't exit, as it jumps from version 2.9 to 5.

migrated from crypto.stackexchange.com Oct 15 at 0:36

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • Sounds like a question about the intricacies of the rar format and behavior of the two programs in question rather than about cryptography—a better fit for superuser, perhaps? – Squeamish Ossifrage Oct 14 at 23:16
  • Sounds like a hash collision, or an issue, with your program – Ramhound Oct 15 at 1:13
0

As far as I know, RAR uses 32-bit CRC values for all of its checksum values, both those of files and the archive header. So when brute-forcing passwords, you have 1 in 2^32 (~ 1 in 4 billion) chance of the header checksum matching, even though the decoded header data (and any following file data) is garbage, because the password, and consequently the decryption key, is actually incorrect. My experience brute-forcing RARs seems to confirm this.

Is there any algorithmic explanation for this? Could it be that I've found a password that gets past one stage of the password check but not another?

That's pretty much what happened.

  • With 2 different zip files, and my brute force program only attempting around 5,000 iterations, it doesn't sound right. Maybe it's a flaw in 7zip. – NibblyPig Oct 15 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.