bkcrack
A command-line tool that cracks legacy ZIP encryption using Biham and Kocher's known plaintext attack.
What is bkcrack?
bkcrack is a command-line tool that cracks legacy ZIP file encryption using Biham and Kocher's known plaintext attack. It recovers encryption keys and passwords from ZIP archives encrypted with the vulnerable ZipCrypto algorithm when at least 12 bytes of plaintext are known. The tool can decrypt data, remove passwords from archives, and recover original passwords through bruteforce or mask-based methods.
Security researchers, digital forensics professionals, and users who need to recover access to legacy encrypted ZIP archives where passwords have been lost but some plaintext is available.
bkcrack provides a practical implementation of an academic cryptographic attack against a specific vulnerable encryption algorithm, offering capabilities not found in general password recovery tools. It's specifically optimized for the ZipCrypto weakness and includes features for directly modifying encrypted archives once keys are recovered.
Overview
Crack legacy zip encryption with Biham and Kocher's known plaintext attack.
Use Cases
Best For
- Recovering passwords from legacy encrypted ZIP archives
- Accessing encrypted ZIP files when you have partial plaintext knowledge
- Digital forensics investigations involving encrypted ZIP evidence
- Security research on cryptographic weaknesses in legacy systems
- Recovering data from old encrypted backups with forgotten passwords
- Testing the security of ZIP encryption implementations
Not Ideal For
- Recovering passwords from ZIP archives encrypted with AES-256 or other modern encryption standards
- Situations where no known plaintext is available for the encrypted ZIP file
- Users who prefer graphical user interfaces over command-line tools for security tasks
- General-purpose file encryption cracking beyond the specific ZipCrypto vulnerability
Pros & Cons
Pros
Implements Biham and Kocher's cryptographic attack to recover internal keys from as little as 12 bytes of plaintext, with faster performance when more contiguous plaintext is available, as detailed in the README's overview.
Supports data from ZIP archives or raw files, with options for offsets and sparse plaintext, allowing adaptation to various recovery scenarios, as shown in the usage examples with -o and -x flags.
Offers key recovery, password bruteforce/mask recovery, archive password removal/change, and data decryption in one tool, including utilities like inflate.py for decompression, all documented in the README.
Includes a tutorial in the example folder, detailed command-line instructions, and clear explanations of charsets and recovery methods, making it accessible for practical use.
Cons
Only effective against the legacy ZipCrypto algorithm; it cannot attack ZIP files encrypted with modern AES, which is a significant limitation admitted in the README's focus on 'legacy encryption'.
Requires at least 12 bytes of known plaintext, which is not always available, restricting its utility in password recovery without prior knowledge, a fundamental barrier highlighted in the usage section.
Lacks a graphical user interface, making it less accessible for users unfamiliar with terminal commands and complex option flags like -m for masks or -s for custom charsets.
Frequently Asked Questions
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.