[SOLVED] Multiple password for encrypted Zip? How?

Toggle sidebar Toggle sidebar
Status
Not open for further replies.
B

BringTheRuck

Reputable
Jan 1, 2015
5
0
4,510
Hello all, I have an odd questions that came to mind recently. This involves Linux but as I did not see a specific Linux forum I figured this would be the best place to post.

In Linux I created a very weak zip file, "zip --encrypt secure.zip test.txt" and assigned it password "test123". The ZIP file is successfully locked. When running a bruteforce attack on the zip file I am given another possible password, "d6". Oddly enough, both passwords work to unzip the file.

Why is this? This is driving me insane not knowing why, both passwords are completely different in Hex, Decimal, and Binary...

EDIT: The secondary password seems to change each time the file is created regardless if the first one is the same. This is very confusing...

Thanks in advance for the clarification.
 
Solution
Someone Somewhere
Most encryption methods require a fixed length key.

To get this from a variable length password, they typically use a 'hash function'. This converts an input of any length into a repeatable but (ideally) random output.

In this case, it's possible that 'd6' and 'test123' have the same output hash, which is called a 'hash collision'. While all hashes have this as a potential issue, it shouldn't be this blatant.

A quick google also finds that ZIP's V2.0's encryption algorithms are considered very insecure. Newer versions of ZIP support stronger encryption (AES). It's likely that the linux zip utility uses the old encryption for backwards-compatibility purposes.

Sort by date Sort by votes
Someone Somewhere

Someone Somewhere

Titan
Sep 23, 2012
22,291
8
84,965
Most encryption methods require a fixed length key.

To get this from a variable length password, they typically use a 'hash function'. This converts an input of any length into a repeatable but (ideally) random output.

In this case, it's possible that 'd6' and 'test123' have the same output hash, which is called a 'hash collision'. While all hashes have this as a potential issue, it shouldn't be this blatant.

A quick google also finds that ZIP's V2.0's encryption algorithms are considered very insecure. Newer versions of ZIP support stronger encryption (AES). It's likely that the linux zip utility uses the old encryption for backwards-compatibility purposes.

 
Upvote 0 Downvote
Solution
Status
Not open for further replies.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom