From: nevries@accucx.cc.ruu.nl (Nico de Vries.)
Newsgroups: comp.compression
Subject: Re: PKZIP encryption contest
Date: 14 Apr 92 19:47:58 GMT
Organization: Academic Computer Centre Utrecht

In <1992Apr14.180855.20221@cco.caltech.edu> madler@cco.caltech.edu (Mark Adler) writes:


>Nico feels that PK had to use:
>>>    - special tricks to prevent PKZIP from imploding the file (strange)

>Steve's claim was that the file would compress using implode, but not
>compress using shrink.  If that's true, then PKZIP 1.1 could have made
>pkcontst.zip using the shrink only option (-es?), which would choose to
>store the file since shrinking it would make it bigger.

Hmmm. OK I made a mistake here. But then I start wondering whet the contents
of the file are. I assumed ASCII but that seems not to be the case since
I can't imaging an ASCII file fo this size which is not shrinkable. If the
file does contain lots of noncense than the contest becomes even less realistic
IMHO. It is althought possible they put some "HE!!! You did it" in the beginning
or whatever.
Another question is. Is it possible with PKZIP to use ALL 256 values in a 
password. Including NULL, CR, LF, TAB etc. The contest docu claims it has
been compressed by such a password. Or would this just be a misleader
(and the password be ZZZZZZZ :-).

>I don't want to look like I'm defending PKWare here--I also think that
>this contest is way bogus.  Mainly because there is only one file, and
>that it is not compressed.  There should be several, compressed entries
>(all using the same password).  I don't think that arbitrary byte
Agreed.

>passwords is as big a deal, since if he restricted to printables or
>something, he would have simply made the password longer.  Either way
Agreed.

>it's just as hard.  What makes it most unrealistic is that the file is
>nothing like your typical zip file, which has (and I repeat) many 
>compressed entries.
Agreed. But I also have to agree with PK. He claims knowing parts of
the plaintext wouldn't help you in cracking. The PK scheme seems capable
to handle plaintext attacks. I don't understand why PK didn't make the test
more realistic. I would assume he would trust his own scheme.

>I have no reason to believe that they did not use PKZIP 1.10 to make
>the file.  However, I also have no reason to believe that they did.
>They haven't said whether they did or not.  If they did not, this also
>adds greatly to the bogosity.

Just another thougth BTW. Does anyone know how PK generates its random
numbers. If it is some derivate from the timer than it should be possible
to reconstruct it from the file time (in theory, it would at least limit
the possibilities). If it also depends on the plaintext and the password
it might become a lot harder to do.

>Mark Adler
>madler@tybalt.caltech.edu

Nico E. de Vries
-----------------------------------------------------------------------------
USENET: nevries@cc.ruu.nl                 FIDO      : 2:281/708.1  (very new) 
VOICE : +31-3404-24931 (+31-30-316931)    FAX       : +31-30-312033 
BBS   : +31-30-341401 (Nico De_vries)     COMPUSERVE: (coming)
MAIL  : Hortensialaan 45, 3702VE, Zeist, The Netherlands 

IMPORT StdDisclaimer, MyPersonalOpinion;          - O   Place reserved for
Complaints about my spelling to DEV/NUL please.    |    funny joke. Sugestions 
I work for BITECH, I don't SPEAK for BITECH.      \_/   apreciated. <== WELL??