1
$\begingroup$

If I have an original file and a WinRAR password protected .rar file containing that file, can I extract the password?

$\endgroup$
  • 1
    $\begingroup$ Known plaintext attacks don't work against modern ciphers. $\endgroup$ – CodesInChaos Jun 29 '15 at 14:27
  • $\begingroup$ so there is no way?? $\endgroup$ – ASD Jun 29 '15 at 14:28
  • 2
    $\begingroup$ I can't say for sure without having looked at the winrar crypto in detail, but I consider it pretty unlikely since it'd require an unusually dumb mistake. Probably the best you can do is running a program that tests many password candidates, but that's only feasible for simple passwords. $\endgroup$ – CodesInChaos Jun 29 '15 at 14:32
  • $\begingroup$ can i extract that encrypted file ?because password is on file not on winrar file.after that comapring original file and encrypted file of that original file there is way to get password?? $\endgroup$ – ASD Jun 29 '15 at 14:36
  • 1
    $\begingroup$ @ASD, I still don't have a clear picture of what is encrypted and how. The answer below by otus is correct if RAR encryption is used. But, based on our discussions it sounds like that might not be the case. It sounds like files are encrypted using some custom method then all the encrypted files are combined using WinRAR. $\endgroup$ – mikeazo Jul 13 '15 at 13:20
6
$\begingroup$

No, in general you cannot.

WinRAR uses AES (128 or 256 depending on version) for encryption, which does not allow key recovery even with know plaintext and ciphertext.

It also uses key stretching to derive the encryption key from a password. The algorithm used in newer versions is PBKDF2 with a version dependent iteration count. So a key-guessing attack is only possible for low entropy passwords. There is a verifier in the file format that allows checking password guesses, so knowing a plaintext and/or ciphertext does not give any advantage there either.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.