Re:An encrypted ZIP file can have two correct passwords – he...
by netsharc on Sunday August 21, 2022 @06:14PM
(#32545017)
The article seems to be very repetitive in the way it explains things, but TL;DR:
> When producing password-protected ZIP archives with AES-256 mode enabled, the ZIP format uses the PBKDF2 algorithm and hashes the password provided by the user, if the password is too long. By too long, we mean longer than 64 bytes (characters), explains the researcher.
So the first accepted password would be the overly long one, and the second accepted password is the ASCII representation of the SHA1 hash of that long password. The researcher used a modified version hashcat to get a password which SHA1 hash is also ASCII.
> When producing password-protected ZIP archives with AES-256 mode enabled, the ZIP format uses the PBKDF2 algorithm and hashes the password provided by the user, if the password is too long. By too long, we mean longer than 64 bytes (characters), explains the researcher.
So the first accepted password would be the overly long one, and the second accepted password is the ASCII representation of the SHA1 hash of that long password. The researcher used a modified version hashcat to get a password which SHA1 hash is also ASCII.