How long does it take to crack an eight character zip compressed password ?

60 Views Asked by At

How long does it take to crack an eight character zip compressed password ?

Passwords consist of uppercase, lowercase, and numbers。 How long does it take to crack with current computer computing power? How to calculate it?

Thank you for your answer

1

There are 1 best solutions below

0
Royce Williams On

As Mark Adler noted, more info is needed for absolute answers. But with a couple of modest assumptions, a relative answer is possible.

In practical terms, a random 8-character password for a PKZIP compressed file can be cracked in six days on prosumer-grade hardware (which means that it's too short!). And the information below should enable you to calculate it for your case.

The worst-case keyspace you'd need to exhaust (if no other information is known) is 95^8, or about 6.634 × 10^15.

hashcat currently supports the following zip-related hash types:

$ hashcat -hh | egrep -i zip | sort -n
  11600 | 7-Zip                                      | Archive
  13600 | WinZip                                     | Archive
  17200 | PKZIP (Compressed)                         | Archive
  17210 | PKZIP (Uncompressed)                       | Archive
  17220 | PKZIP (Compressed Multi-File)              | Archive
  17225 | PKZIP (Mixed Multi-File)                   | Archive
  17230 | PKZIP (Mixed Multi-File Checksum-Only)     | Archive
  20500 | PKZIP Master Key                           | Archive
  20510 | PKZIP Master Key (6 byte optimization)     | Archive
  23001 | SecureZIP AES-128                          | Archive
  23002 | SecureZIP AES-192                          | Archive
  23003 | SecureZIP AES-256                          | Archive

... which benchmark at the following hashrates on two RTX 4090s:

$ hashcat --version
v6.2.6-846-g4d412c8e0

$ for mode in 11600 17220 17200 17225 17230 17210 20500 20510 23001 23002 23003 13600; do hashcat --quiet -b -m ${mode}; done
---------------------------------------------
* Hash-Mode 11600 (7-Zip) [Iterations: 16384]
---------------------------------------------

Speed.#1.........:  2592.2 kH/s (91.15ms) @ Accel:64 Loops:4096 Thr:128 Vec:1
Speed.#2.........:  2500.3 kH/s (95.12ms) @ Accel:64 Loops:4096 Thr:128 Vec:1
Speed.#*.........:  5092.5 kH/s

-------------------------------------------------
* Hash-Mode 17220 (PKZIP (Compressed Multi-File))
-------------------------------------------------

Speed.#1.........: 45636.1 MH/s (46.69ms) @ Accel:1024 Loops:512 Thr:32 Vec:1
Speed.#2.........: 44164.4 MH/s (48.25ms) @ Accel:1024 Loops:512 Thr:32 Vec:1
Speed.#*.........: 89800.5 MH/s

--------------------------------------
* Hash-Mode 17200 (PKZIP (Compressed))
--------------------------------------

Speed.#1.........:  6287.0 MH/s (18.49ms) @ Accel:28 Loops:1024 Thr:32 Vec:1
Speed.#2.........:  6178.8 MH/s (18.73ms) @ Accel:28 Loops:1024 Thr:32 Vec:1
Speed.#*.........: 12465.8 MH/s

--------------------------------------------
* Hash-Mode 17225 (PKZIP (Mixed Multi-File))
--------------------------------------------

Speed.#1.........: 54859.4 MH/s (77.88ms) @ Accel:1024 Loops:1024 Thr:32 Vec:1
Speed.#2.........: 53166.2 MH/s (80.35ms) @ Accel:1024 Loops:1024 Thr:32 Vec:1
Speed.#*.........:   108.0 GH/s

----------------------------------------------------------
* Hash-Mode 17230 (PKZIP (Mixed Multi-File Checksum-Only))
----------------------------------------------------------

Speed.#1.........: 61360.1 MH/s (34.66ms) @ Accel:128 Loops:512 Thr:256 Vec:1
Speed.#2.........: 59158.4 MH/s (35.95ms) @ Accel:128 Loops:512 Thr:256 Vec:1
Speed.#*.........:   120.5 GH/s

----------------------------------------
* Hash-Mode 17210 (PKZIP (Uncompressed))
----------------------------------------

Speed.#1.........:  8513.4 MH/s (31.20ms) @ Accel:512 Loops:64 Thr:64 Vec:1
Speed.#2.........:  8279.8 MH/s (32.08ms) @ Accel:512 Loops:64 Thr:64 Vec:1
Speed.#*.........: 16793.2 MH/s

------------------------------------
* Hash-Mode 20500 (PKZIP Master Key)
------------------------------------

Speed.#1.........:   530.9 GH/s (7.82ms) @ Accel:1024 Loops:1024 Thr:32 Vec:1
Speed.#2.........:   513.9 GH/s (8.09ms) @ Accel:1024 Loops:1024 Thr:32 Vec:1
Speed.#*.........:  1044.8 GH/s

----------------------------------------------------------
* Hash-Mode 20510 (PKZIP Master Key (6 byte optimization))
----------------------------------------------------------

Speed.#1.........:   122.0 GH/s (34.88ms) @ Accel:512 Loops:1024 Thr:64 Vec:1
Speed.#2.........:   118.0 GH/s (36.04ms) @ Accel:512 Loops:1024 Thr:64 Vec:1
Speed.#*.........:   240.0 GH/s

-------------------------------------
* Hash-Mode 23001 (SecureZIP AES-128)
-------------------------------------

Speed.#1.........:  7110.7 MH/s (75.21ms) @ Accel:16 Loops:1024 Thr:256 Vec:1
Speed.#2.........:  6880.1 MH/s (77.72ms) @ Accel:16 Loops:1024 Thr:256 Vec:1
Speed.#*.........: 13990.8 MH/s

-------------------------------------
* Hash-Mode 23002 (SecureZIP AES-192)
-------------------------------------

Speed.#1.........:  5282.7 MH/s (50.51ms) @ Accel:16 Loops:512 Thr:256 Vec:1
Speed.#2.........:  5113.5 MH/s (52.20ms) @ Accel:16 Loops:512 Thr:256 Vec:1
Speed.#*.........: 10396.2 MH/s

-------------------------------------
* Hash-Mode 23003 (SecureZIP AES-256)
-------------------------------------

Speed.#1.........:  4562.9 MH/s (58.54ms) @ Accel:8 Loops:1024 Thr:256 Vec:1
Speed.#2.........:  4408.0 MH/s (60.59ms) @ Accel:8 Loops:1024 Thr:256 Vec:1
Speed.#*.........:  8971.0 MH/s

--------------------------------------------
* Hash-Mode 13600 (WinZip) [Iterations: 999]
--------------------------------------------

Speed.#1.........: 19108.6 kH/s (50.69ms) @ Accel:16 Loops:999 Thr:512 Vec:1
Speed.#2.........: 17769.8 kH/s (52.15ms) @ Accel:16 Loops:999 Thr:512 Vec:1
Speed.#*.........: 36878.3 kH/s

Once you determine your file type and hardware, you now have the elements necessary to calculate the worst-case exhaustion time (adjusting your assumptions to match your case).

For example, on this hardware, the 17210 (PKZIP compressed) format can be attacked at 12465.8 MH/s (millions of hashes per second). For this password, you have to exhaust a maximum of 95^8 possibilities. Dividing by 60 to get minutes, 60 to get hours, and 24 to get days ... yields six days:

(95^8) / 12465000000 / 60 / 60 / 24 = ~6.16 days