openwall / openwall/john

Support PKZIP Master Key

Open
#3,971 5 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
C
Stars
13.6k
Forks
2.6k
PR merge metrics
No merged PRs in 30d

Description

We might want to first decide on the general issue of supporting (or not) cracking of non-passwords in JtR. For example, we could also want to add cracking of raw DES, like hashcat already has, but perhaps not only on GPU, but also on FPGA. That said, here goes:

There's this recent paper about PKZIP cracking on GPU, which gives plenty of credit to our work and shows that a GPU implementation of what we already do on CPU is worthwhile (we might want to create a separate GitHub issue for that):

http://www.insticc.org/node/TechnicalProgram/icissp/presentationDetails/73605

There's also this recent addition to hashcat:

https://github.com/hashcat/hashcat/pull/2032
https://twitter.com/hashcat/status/1129441728761610242

where the Master Key is cracked by having it effectively reduced from 96 to just 48 still-unknown bits, if I understand correctly.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file, test, or entry point is named. First read the existing CPU PKZIP implementation and the linked hashcat references, then resolve whether non-password cracking and a PKZIP Master Key implementation are in scope; completion would require an agreed design and corresponding implementation tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
cryptography, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.