At least his verbal description, as if I had searched the entire Internet, but I never found it. I want to try to crack the hash by brute force, and for this you need to have this algorithm at hand? I will be very grateful for any help
1 Answer
It's not clear what the question means by CRC-96, or hash. The CRC in the original ZIP file format is 32-bit.
Perhaps it's asked how the password is changed into a 96-bit key in the original PKWARE encryption (often refered to as ZipCrypto). That's described in section 6.1.5 of PKWARE's appnote.
Key(0) <- 305419896
Key(1) <- 591751049
Key(2) <- 878082192
loop for i <- 0 to length(password)-1
update_keys(password(i))
end loop
Where update_keys() is defined as:
update_keys(char):
Key(0) <- crc32(key(0),char)
Key(1) <- Key(1) + (Key(0) & 000000ffH)
Key(1) <- Key(1) * 134775813 + 1
Key(2) <- crc32(key(2),key(1) >> 24)
end update_keys
Where crc32(old_crc,char) is a routine that given a CRC value and a
character, returns an updated CRC value after applying the CRC-32
algorithm (…)
Sections 6.1.6 that follows describes sort of a key salting, including a check value intended to catch most accidental miss-keying of the password. This check value was reduced from two to one byte by PKWARE starting 1992 (but some Unix zip programs have produced archives with two check bytes many years after that). I have always wondered if the check bytes are in practice enough to break PKZIP encryption when there are multiple files in an archive, and how many files are needed.
Section 6.1.7 describe the decryption.
For bibliography on some attacks, see this.
-
$\begingroup$ In general, it's just that all the ways to determine the type of hashes that I found say that my hash belongs to CRC-96(ZIP), and I myself do not know what it is, if you can give at least some information, it would be great. $\endgroup$ Commented Nov 6 at 18:10