A method for efficiently identifying the correctness of the password of a compressed and encrypted file

Abstract

The present invention relates to the technical field of identifying compressed and encrypted files. The present invention relates to a method for efficiently identifying the correctness of the password of a compressed and encrypted file. The method includes the following steps: determining whether the compressed content meets the conditions for quick identification, verifying the rationality of the compression coding table, and determining the correctness of the password according to the characteristics of the compressed content. When the conditions are met, the method of the present invention is used to identify the password of the compressed and encrypted file, and the false positive rate is ≤2 48 , compared with the standard judgment process, it is not necessary to decrypt and decompress all the data. Only the first 16 bytes of the data header need to be processed. The maximum length of the coding table is 256 bytes, and the total data processing volume does not exceed 272 bytes. The processing speed difference is proportional to the length of the compressed data. Compared with the common methods for identifying compressed and encrypted files, the identification speed is significantly improved.

Description

Technical Field

[0001] The present invention relates to the technical field of identifying compressed and encrypted files, and more specifically, to a method for efficiently identifying the correctness of passwords for compressed and encrypted files. Background Art

[0002] Password identification for compressed and encrypted files is an important part of password cracking. WinRAR4 and WinZip are the most common compression software. By calculating the cyclic redundancy check or hash verification value of the compressed content to determine the correctness of the password, it is necessary to complete steps such as decrypting, decompressing, and calculating the verification value of the entire compressed content. When performing password cracking, the verification speed cannot meet the requirements. By analyzing the compression algorithms and processes of common compression software, under certain conditions, rapid password identification is achieved by using compression algorithm coding verification and content feature verification. Under typical conditions (when the file compression size is 100,000 bytes and the decompressed size is 200,000 bytes), the password verification speed is increased by more than 500 times. Therefore, in order to improve the efficiency of password identification for compressed and encrypted files, a method for efficiently identifying the correctness of passwords for compressed and encrypted files is proposed. Summary of the Invention

[0003] The purpose of the present invention is to provide a method for efficiently identifying the correctness of passwords for compressed and encrypted files to solve the problems raised in the above background art.

[0004] To achieve the above purpose, a method for efficiently identifying the correctness of passwords for compressed and encrypted files is provided, including the following steps:

[0005] S1. Determine whether the compressed content meets the conditions for rapid identification;

[0006] S2. Check the rationality of the compression coding table;

[0007] S3. Determine the correctness of the password according to the characteristics of the compressed content.

[0008] As a further improvement of this technical solution, the method steps for determining whether the compressed content meets the conditions for rapid identification in S1 are as follows:

[0009] S1.1. Establish a table according to different types according to the file formats that can be rapidly identified;

[0010] S1.2. Compare the compressed and encrypted file with the file formats in the table;

[0011] S1.3. Determine whether the compressed and encrypted file can be rapidly identified according to the comparison results in S1.2.

[0012] As a further improvement of this technical solution, the method steps for checking the rationality of the compression coding table in S2 are as follows:

[0013] S2.1. Determine the legality of the compressed and encrypted file judged in S1.3;

[0014] S2.2. Detect the compressed and encrypted files compressed by WinRAR4 and WinZip separately.

[0015] As a further improvement of this technical solution, the method for judging the legality of the compressed and encrypted file in S2.1 is as follows:

[0016] S2.1.1. Determine the longest code length;

[0017] S2.1.2. Generate the last code according to the longest code length;

[0018] S2.1.3. Judge whether the compressed and encrypted file is legal according to the last code.

[0019] As a further improvement of this technical solution, the detection method for the compressed and encrypted file compressed by WinRAR4 in S2.2 is as follows:

[0020] S2.2.1. Extract the code table length code, check its legality, if it is illegal, then it fails;

[0021] S2.2.2. Decode the data code table, check its legality, if it is illegal, then it fails;

[0022] S2.2.3. Pass the code detection.

[0023] As a further improvement of this technical solution, the detection method for the compressed and encrypted file compressed by WinZip in S2.2 is as follows:

[0024] S2.2.4. Extract the number of code table length codes, the number of symbol codes, and the number of distance codes;

[0025] S2.2.5. Extract the code table length code, check its legality, if it is illegal, then it fails;

[0026] S2.2.6. Decode the symbol code table, check its legality, if it is illegal, then it fails;

[0027] S2.2.7. Decode the distance code table, check its legality, if it is illegal, then it fails;

[0028] S2.2.8. Pass the code detection.

[0029] As a further improvement of this technical solution, the method for judging the correctness of the password according to the characteristics of the compressed content in S3 is as follows:

[0030] S3.1. Decompress the first 16 bytes of the data according to the obtained coding table;

[0031] S3.2. Determine the feature code group (one or more groups) according to the file type of the compressed content;

[0032] S3.3. Compare the data with the feature code group. If the match is successful, it passes.

[0033] Compared with the prior art, the beneficial effects of the present invention are:

[0034] In the method for efficiently discriminating the correctness of the password of a compressed and encrypted file, under the condition of meeting the requirements, when using this method to discriminate the password of a compressed and encrypted file, the misjudgment rate ≤ 2 48 , compared with the standard judgment process, it is not necessary to decrypt and decompress all the data. Only the first 16 bytes of the data header need to be processed. The maximum length of the coding table is 256 bytes, and the total data processing volume does not exceed 272 bytes. The processing speed difference is proportional to the length of the compressed data. Compared with the common methods for discriminating compressed and encrypted files, the discrimination speed is significantly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 is one of the overall step flowcharts of the present invention;

[0036] Figure 2 is the method flow block diagram for judging whether the compressed content meets the fast discrimination conditions of the present invention;

[0037] Figure 3 is the method flow block diagram for verifying the rationality of the compressed coding table of the present invention;

[0038] Figure 4 is the method flow block diagram for judging the legality of the compressed and encrypted file of the present invention;

[0039] Figure 5 is the method flow block diagram for detecting the compressed and encrypted file compressed by WinRAR4 of the present invention;

[0040] Figure 6 is the method flow block diagram for detecting the compressed and encrypted file compressed by WinZip of the present invention;

[0041] Figure 7 is the method flow block diagram for determining the correctness of the password according to the characteristics of the compressed content of the present invention;

[0042] Figure 8 is the second overall step flowchart of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0043] Next, in combination with the accompanying drawings in the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0044] Embodiment 1

[0045] Please refer to Figures 1 - 8 As shown, the purpose of this embodiment is to provide a method for efficiently discriminating the correctness of the password of a compressed and encrypted file, including the following steps:

[0046] S1. Determine whether the compressed content meets the conditions for quick discrimination;

[0047] S2. Check the rationality of the compression coding table;

[0048] S3. Determine the correctness of the password according to the characteristics of the compressed content.

[0049] The method steps for determining whether the compressed content meets the conditions for quick discrimination in S1 are as follows:

[0050] S1.1. Establish a table according to different types according to the file formats that can be quickly discriminated. Please refer to Table 1 shown below. The compressed and encrypted file types in the table can be quickly discriminated, which is convenient for quickly identifying the compressed and encrypted files that can be discriminated;

[0051]

[0052] Table 1

[0053] S1.2. Compare the compressed and encrypted file with the file formats in the table;

[0054] S1.3. Determine whether the compressed and encrypted file can be quickly discriminated according to the comparison result in S1.2;

[0055] In specific use, establish a table for the file types that can be quickly discriminated, compare the format type of the compressed and encrypted file with the table, and continue to discriminate the compressed and encrypted files that meet the conditions for quick discrimination, while using common standard verification methods for the compressed and encrypted files that do not meet the conditions for quick discrimination.

[0056] The method steps for checking the rationality of the compression coding table in S2 are as follows:

[0057] S2.1. Judge the legality of the compressed and encrypted file determined by S1.3;

[0058] S2.2. Detect the compressed and encrypted files compressed by WinRAR4 and WinZip separately.

[0059] The steps of the method for determining the legality of the compressed and encrypted file in S2.1 are as follows:

[0060] S2.1.1. Determine the maximum code length;

[0061] S2.1.2. Generate the last code based on the longest code length;

[0062] S2.1.3. Determine whether the compressed and encrypted file is legal based on the last code;

[0063] WinRAR4 and WinZip both use dictionary matching compression algorithms. Compressed data is stored using Huffman coding. Huffman coding is an ordered variable-length code that constructs codewords with the shortest average length based on the probability of symbol occurrence. The coding process is the construction process of the optimal binary tree. Therefore, the read code needs to meet the optimal binary tree conditions. Therefore, the method for judging the legitimacy of Huffman coding is as follows:

[0064] Assuming that the maximum code length of the generated code table is n, the last code generated according to the code length must be n 1s. If the above is true, it means that the code is legal; if the above is not true, it means that the code is illegal.

[0065] The steps of the method for detecting the compressed and encrypted file compressed by WinRAR4 in S2.2 are as follows:

[0066] S2.2.1. Extract the code table length code and check its legality. If it is illegal, the code will be rejected.

[0067] S2.2.2. Decode the data code table and check its legality. If it is illegal, the application will be rejected.

[0068] S2.2.3, pass the coding test;

[0069] WinRAR4 compressed data has only one data code table. In order to save code table storage space, the code length of the data code table is Huffman encoded to generate the code table length code. The compressed file storage content and order are shown in Table 2:

[0070] Category Stored content Code length Quantity Code table length encoding Encoding code length Fixed length, 4 bits At most 20 Digital code table Encoding code length Variable length, maximum 15 bits At most 404 Compressed data Compression encoding Variable length, maximum 15 bits Variable

[0071] Table 2

[0072] The steps of the method for detecting the compressed and encrypted file compressed by WinZip in S2.2 are as follows:

[0073] S2.2.4. Extract the number of length codes, symbol codes, and distance codes from the code table;

[0074] S2.2.5. Extract the Huffman code table length encoding and check its legality. If it is illegal, the process fails.

[0075] S2.2.6. Decode the symbol code table and check its legality. If it is illegal, the process fails.

[0076] S2.2.7. Decode the distance code table and check its legality. If it is illegal, the process fails.

[0077] S2.2.8. Pass the encoding detection.

[0078] WinZip compressed data has two code tables: the symbol code table and the distance code table. The symbol code table has a maximum of 288 encodings, and the distance code table has a maximum of 32 encodings. The maximum code length is 15. To save storage space for the code tables, Huffman encoding is performed on the code lengths of these two code tables to generate the code table length encoding. The code table length encoding has a maximum of 19 encodings, and the maximum code length is 7. The content stored in the compressed file is shown in Table 3:

[0079] Category Stored content Code length Quantity Code table length encoding quantity Encoding code length - 4 4 bits 1 Symbol code quantity Encoding quantity - 257 5 bits 1 Distance code quantity Encoding quantity - 1 5 bits 1 Code table length encoding Encoding code length Fixed length, 3 bits At most 19 Symbol code table Encoding code length Variable length, maximum 7 bits At most 288 Distance code table Encoding code length Variable length, maximum 7 bits At most 32 Compressed data Compression encoding Variable length, maximum 15 bits Variable

[0080] Table 3

[0081] The steps for determining the method of judging the password correctness according to the characteristics of the compressed content in S3 are as follows:

[0082] S3.1. According to the obtained code table, decompress the first 16 bytes of the data.

[0083] S3.2. Determine the characteristic code group (one or more groups) according to the file type of the compressed content.

[0084] S3.3. Compare the data with the characteristic code group. If the match is successful, it passes.

[0085] Under satisfied conditions, when using this method to distinguish the password of the compressed encrypted file, the misjudgment rate ≤ 2 48 , compared with the standard judgment process, it is not necessary to decrypt and decompress all the data. Only the first 16 bytes of the data header need to be processed. The maximum length of the code table is 256 bytes, and the total data processing volume does not exceed 272 bytes. The processing speed difference is proportional to the length of the compressed data. Assuming that the compressed file size is 130,000 bytes and the decompressed size is 200,000 bytes, the processing speed difference is about 500 times. Compared with the common methods for distinguishing compressed encrypted files, the distinguishing speed is significantly improved.

[0086] The foregoing has shown and described the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments. The above embodiments and the descriptions in the specification are only preferred examples of the present invention and are not used to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention will have various changes and improvements, and these changes and improvements all fall within the scope of the present invention claimed. The scope of the present invention claimed is defined by the appended claims and their equivalents.

Claims

1. A method for efficiently screening the correctness of the password of a compressed and encrypted file, characterized in that, Including the following steps: S1. Determine whether the compressed content meets the quick screening conditions; S2. Check the rationality of the compression encoding code table; S3. Determine the correctness of the password according to the characteristics of the compressed content; The method steps for determining whether the compressed content meets the quick screening conditions in S1 are as follows: S1.

1. Establish a table according to the quickly screenable file formats by different types; S1.

2. Compare the compressed encrypted file with the file formats in the table; S1.

3. Determine whether the compressed encrypted file can be quickly screened according to the comparison result in S1.2; The method steps for checking the rationality of the compression encoding code table in S2 are as follows: S2.

1. Determine the legality of the compressed encrypted file judged by S1.3; S2.

2. Detect the compressed encrypted files compressed by WinRAR4 and WinZip respectively; The method steps for determining the legality of the compressed encrypted file in S2.1 are as follows: S2.1.

1. Determine the longest code length; S2.1.

2. Generate the last code according to the longest code length; S2.1.

3. Determine whether the compressed encrypted file is legal according to the last code; The detection method steps for the compressed encrypted file compressed by WinRAR4 in S2.2 are as follows: S2.2.

1. Extract the code table length code, check the legality, if it is illegal, then it fails; S2.2.

2. Decode the data code table, check the legality, if it is illegal, then it fails; S2.2.

3. Pass the coding detection; The detection method steps for the compressed encrypted file compressed by WinZip in S2.2 are as follows: S2.2.

4. Extract the code table length code quantity, symbol code quantity, and distance code quantity; S2.2.

5. Extract the code table length code, check the legality, if it is illegal, then it fails; S2.2.

6. Decode the symbol code table, check the legality, if it is illegal, then it fails; S2.2.

7. Decode the distance code table, check the legality, if it is illegal, then it fails; S2.2.

8. Pass the coding detection; The method steps for determining the correctness of the password according to the characteristics of the compressed content in S3 are as follows: S3.

1. According to the obtained coding code table, decompress the first 16 bytes of the data; S3.

2. Determine the characteristic code group (one group or multiple groups) according to the file type of the compressed content; S3.

3. Compare the data with the characteristic code group, if the match is successful, then it passes.

Images