neelam agrawal rodney beede yogesh virkar
DESCRIPTION
PZAPR Parallel Zip Archive Password Recovery CSCI5576 - High Perf Sci Computing Univ. of Colorado Spring 2011. Neelam Agrawal Rodney Beede Yogesh Virkar. 2011-04-29. Topics. The Team Introduction Framework Brute Force Dictionary Password Verification Process Data Collection - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/1.jpg)
PZAPRParallel Zip Archive Password
Recovery
CSCI5576 - High Perf Sci ComputingUniv. of Colorado
Spring 2011
Neelam AgrawalRodney BeedeYogesh Virkar
2011-04-29
![Page 2: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/2.jpg)
Topics• The Team• Introduction• Framework• Brute Force• Dictionary• Password Verification Process• Data Collection• Results & Conclusions• Questions
![Page 3: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/3.jpg)
Introduction• ZipCrypto was first ZIP encryption
o Easily defeated
• AES-256o Standardo 2003 integrated into ZIP spec
• Password recovery of ZIP's not newo Proprietary companies
• Open source solutiono Free (if you have hardware)
![Page 4: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/4.jpg)
Framework• MPI with C++ & C
• 3 Componentso Password Generator
Brute Force Dictionary
o Password Verification
• Command Parameterso Log Patho Zip Patho Method (BRUTE | DICTIONARY)o Dictionary Path
![Page 5: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/5.jpg)
Initialize password generator
Next Password(BRUTE|DICTIONARY)
AttemptPassword()
Correct?
Tell Everyone Else I Found It
Anyone Else Find It?
END
NO MORE?
NO YES
NO YES
Framework (cont)
Initialize decrypt engine
![Page 6: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/6.jpg)
Brute Force• All alphanumeric from 1 to 7 length
o 0-9, A-Z, a-zo 62 possible characters
• 3,579,345,993,194 possible passwordso 62^7 + 62^6 + ... 62^1
• Traditional incremento 'a' + 1 ==> 'b'o 'az' + 1 ==> 'b0'o Not feasible for parallel
![Page 7: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/7.jpg)
Brute Force - Algorithm• Pick number from 1 to 3 trillion
o Called position• Know password without increment• The Algorithm:
f(position) = factor1 * (ALPHA_LEN)^(n - 1) + factor2 * (ALPHA_LEN)^(n - 2) + ... + factorn-1 * (ALPHA_LEN)^(n - (n-1)) + factorn * (ALPHA_LEN)^(n - n)
![Page 8: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/8.jpg)
Brute Force - Algorithm (cont)
f(position) = factor1 * (ALPHA_LEN)^(n - 1) + factor2 * (ALPHA_LEN)^(n - 2) + ... + factorn-1 * (ALPHA_LEN)^(n - (n-1)) + factorn * (ALPHA_LEN)^(n - n)
• ALPHA_LEN => Alphabet lengtho Number possible characterso 62 (easy to expand)
![Page 9: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/9.jpg)
Brute Force - Algorithm (cont)
f(position) = factor1 * (ALPHA_LEN)^(n - 1) + factor2 * (ALPHA_LEN)^(n - 2) + ... + factorn-1 * (ALPHA_LEN)^(n - (n-1)) + factorn * (ALPHA_LEN)^(n - n)
• n = PASSWORD LENGTHo Start at maximum possible (7)o Based on position find max possible < positiono Password length is 1 more than that length
![Page 10: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/10.jpg)
Brute Force - Algorithm (cont)
f(position) = factor1 * (ALPHA_LEN)^(n - 1) + factor2 * (ALPHA_LEN)^(n - 2) + ... + factorn-1 * (ALPHA_LEN)^(n - (n-1)) + factorn * (ALPHA_LEN)^(n - n)
• factori is the ith character of the passwordo No factor can be zeroo Must borrow from previous if zero
• factori points to alphabet array index
![Page 11: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/11.jpg)
Brute Force - Example• position = 1,000,000• ALPHA_LEN = 62• n = 4 (password length)
f(1,000,000) = factor1 * (62)^(3) + factor2 * (62)^(2) + factor3 * (62)^(1) + factor4 * (62)^(0)
factors = 4, 12, 9, 2
![Page 12: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/12.jpg)
Brute Force - Example (cont)• factors = 4, 12, 9, 2
o Correspond to alphabet indexes
const char PASSWORD_ALPHABET[] = { '\0', // always idx 0'0', '1', '2', '3', '4', '5', '6', '7', '8', '9','A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W','X', 'Y', 'Z','a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w','x', 'y', 'z'};
• PASSWORD = '3', 'B', '8', '1' or "3B81"
![Page 13: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/13.jpg)
Dictionary Attack Mode
• Defeating a cipher or authentication mechanism byo Searching likely possibilities.o i.e. searching part of the key space.
• Not brute force
• Assumption: Potentially weak passwords
![Page 14: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/14.jpg)
Building Dictionary
• Tool Used: John the Rippero Permutationso Combinations
• Commando john --wordlist=all.lst --rules --stdout |
unique mangled.lst
![Page 15: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/15.jpg)
Building Dictionary (2)
• Ruleso l (convert to lowercase)o C (lowercase the first character, and uppercase the rest)o r (reverse: "Fred" ==> "derF")o f (reflect: "Fred" ==> "FredderF")o d (duplicate: "Fred ==> "FredFred"")o ..........and many more!!
• Time to permute: little over 4 hours
• Newer versions: o John the Ripper 1.7.6+
Support for OpenMP directives. (Source:openwall.info/wiki/john/parallelization)
![Page 16: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/16.jpg)
Reading the Dictionary: Initialization
![Page 17: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/17.jpg)
Reading the Dictionary: Indexing
• Indexing uses o displacement array o rank o per process word count
• Load is evenly distributed.o Eg: n = 103, m = 10o n/m = 103/10 = 10o n%m = 103%10 = 3
o rank 0 : 11 wordso rank 1 : 11 wordso rank 2 = 11 wordso rank 3-9 = 10 words
![Page 18: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/18.jpg)
Requirements for Cracking a zip file
• Zip file format• Extracting information from zip file• Verifying the password• Decrypting the file data• Used Dr. Brian Gladman’s code
oC library for AES encryptionoUsed by WinZip
![Page 19: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/19.jpg)
Zip file format
HEADER
FILE NAME
EXTRA FIELD
SALT
PASSWORD VERIFIER
ENCRYPTED FILE DATA
AUTHENTICATION CODE (MAC)
![Page 20: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/20.jpg)
Password Verification Process
ZipFile
GivenPassword
![Page 21: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/21.jpg)
Password Verification Process
ZipFile
SaltGiven
Password
![Page 22: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/22.jpg)
Password Verification Process
ZipFile
SaltGiven
PasswordPassword
Verifier
![Page 23: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/23.jpg)
Password Verification Process
ZipFile
Salt
Password Verifier
GivenPassword
Password Verifier
![Page 24: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/24.jpg)
Password Verification Process
ZipFile
Salt
Password Verifier
Password Verifier
Match
GivenPassword
![Page 25: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/25.jpg)
Password Verification Process
ZipFile
Salt
Password Verifier
GivenPassword
Password Verifier
Match Return False
![Page 26: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/26.jpg)
Password Verification Process
ZipFile
Salt
Password Verifier
GivenPassword
Password Verifier
Match Return False
![Page 27: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/27.jpg)
Password Verification Process
ZipFile
Salt
Password Verifier
Data
GivenPassword
Password Verifier
Match Return False
![Page 28: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/28.jpg)
Password Verification Process
ZipFile
Salt
Password Verifier
Data
GivenPassword
Password Verifier
Match
Decrypt MAC
Return False
![Page 29: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/29.jpg)
Password Verification Process
ZipFile
Salt
Password Verifier
Data
MAC
GivenPassword
Password Verifier
Match
Decrypt MAC
Return False
![Page 30: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/30.jpg)
Password Verification Process
ZipFile
Salt
Password Verifier
Data
MAC
GivenPassword
Password Verifier
Match
Decrypt MAC
Match
Return False
![Page 31: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/31.jpg)
Password Verification Process
ZipFile
Salt
Password Verifier
Data
MAC
GivenPassword
Password Verifier
Match
Decrypt MAC
Match
Return False
Return False
![Page 32: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/32.jpg)
Password Verification Process
ZipFile
Salt
Password Verifier
Data
MAC
GivenPassword
Password Verifier
Match
Decrypt MAC
Match
Return False
Return False
Return True
![Page 33: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/33.jpg)
Speed ups
• Reducing file handling operations• Quick 2 byte check• Parallel implementation on GPU
![Page 34: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/34.jpg)
Data Collection & Testing• Frost
o 32-bit, 700Mhz, 512MB Ram• Janus
o 64-bit, 2.8GHz, 2GB Ramo Ran in 32-bit mode
• Test Typeso Brute and Dictionaryo Nodes: 128, 1024, 2048, 4096o First, Middle, Last, Never
(password positions)• Model
o Passwords / time unit for X nodeso Time to solution for X nodes
![Page 35: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/35.jpg)
Results (Estimated Time: Brute, Janus )
![Page 36: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/36.jpg)
Results(Estimated Time: Brute, Janus vs Frost)
![Page 37: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/37.jpg)
Results(Estimated Time: Dictionary, Janus )
![Page 38: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/38.jpg)
Results(Estimated Time: Dict., Janus vs Frost)
![Page 39: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/39.jpg)
Conclusions• Max throughput (Janus)
o Brute = 172 passwords / secondo Dictionary = 86 passwords / second
• Brute (Janus)o 7 alphanumeric = 60 days with 4096 processorso 8 alphanumeric = 9.9 years with 4096 processorso 10 alphanumeric = 38395 years with 4096 processors
• Dictionary (Janus)o 1 billion = 47.3 minutes with 4096 processorso 100 billion = 78.85 hours with 4096 processors
• Conclusiono Choose good passwords
![Page 40: Neelam Agrawal Rodney Beede Yogesh Virkar](https://reader035.vdocument.in/reader035/viewer/2022062808/568152f6550346895dc1127b/html5/thumbnails/40.jpg)
Questions?
http://code.google.com/p/pzapr/