Practical Known Plaintext Attack Against ZIP Files

The known plaintext attack against ZIP files involves finding an encrypted ZIP file and locating an identical plaintext file with the same size and compression method. By using tools like bkcrack, an attacker can derive the encryption keys by comparing the known plaintext with the encrypted file, ultimately allowing decryption of the ZIP without knowing the original password. bkcrack implements Eli Biham and Paul C. Kocher’s known plaintext attack on the PKZIP stream cipher and needs as little as 12 bytes of known plaintext, at least 8 of them contiguous, to recover the cipher’s internal state, which also decrypts every other entry encrypted with the same password. This technique works particularly well with legacy ZIP encryption (ZipCrypto) and can bypass password protection even when traditional password cracking methods fail.