Re:How we recovered $300k of Bitcoin
by spopejoy on Saturday April 04, 2020 @01:00PM
(#22779545)
You're not alone, wikipedia for zip says
> ZIP supports a simple password-based symmetric encryption system generally known as ZipCrypto. It is documented in the ZIP specification, and known to be seriously flawed. In particular, it is vulnerable to known-plaintext attacks, which are in some cases made worse by poor implementations of random-number generators. https://en.wikipedia.org/wiki/Zip_(file_format)#Encryption
IMO the fact that the author was able to recover the password at all indicates weakness. Something encrypted with AES-GCM would presumably be all but impossible.
> ZIP supports a simple password-based symmetric encryption system generally known as ZipCrypto. It is documented in the ZIP specification, and known to be seriously flawed. In particular, it is vulnerable to known-plaintext attacks, which are in some cases made worse by poor implementations of random-number generators. https://en.wikipedia.org/wiki/Zip_(file_format)#Encryption
IMO the fact that the author was able to recover the password at all indicates weakness. Something encrypted with AES-GCM would presumably be all but impossible.