Password protection in ARJ: 3 characters of password are retrievable

Question

On this site there is information that one can know first 3 characters (bytes) of the password without brute force. I know that ARJ in older versions has very simple encryption, i.e. XOR with passwords.

I can't understand how it is possible to retrieve those 3 characters. Is compression or realization of these archives is weak?

Answer 1

More info on the ARJ format with international (i.e. extremely weak) encryption can be found here at cpsr.org:

A = password
B = compressed text to be encrypted
A' = permuted password
B' = encrypted compressed text
C = constant
^ = XOR

A' = A ^ C
B' = B ^ A'

This is performed character by character.

So if you know the constant (from the application code) and the input and output character then you've got just one variable left: A, the password character:

A = B ^ B' ^ C.

However, the header contains at least 3 static bytes: the header ID and the archiver version number. So for these bytes / characters you don't need to test anything.

There are many other semi known values in the header, but you will need some additional information such as the length of the password to use them to crask the password.