[ILUG] ms word encryption

[Caolan McNamara]

On 12-Apr-99 Caolan McNamara wrote:
>Currently i am interested in decrypting ms documents. Im
>not trying to crack the password. If i have a password
>im trying to find out what is the mechanism to decrypt
>the word document. Anyone have any pointers ? 
>
>Word {8|97} is the particular format im talking about.
>
>>From some serious web searching i believe that the
>encryption algorithm is rc4, of course i dont know
>jack about that though. Was there someone from
>baltimore on this list :-) ?
>
>more details, samples etc at  
>http://www.csn.ul.ie/~caolan/challenge/decryption.README

latest update.

From: Fauzan Mirza <fauzan at dcs.rhbnc.ac.uk>
(ed note: this mirza character is a bit of an encryption head)
>From what I've gathered, Word 97 uses the RC4 stream cipher and a modified
>MD5 hash (I don't know how the hash is modified though). I also know that
>there is a slow key processing stage where the MD5 is iterated a number of
>times (I've forgotten the exact number of times). This alone would imply
>that working out the exact decryption method merely by examining
>ciphertexts would be infeasible. As I said, the easiest thing would be to
>get the details from Microsoft (however, I doubt they'd do this willingly)
>or have Word 97 reverse engineered.

all of this is seconded by and added to by
http://www.crak.com/

looks more and more like this decryption lark is a non runner, *sigh*. 
i wonder about some reverse engineering on word to see if anything can
be squeezed out of it :-). anyone have an email address for a microsoft
employee working on word ?

C.

Real Life: Caolan McNamara           *  Doing: MSc in HCI
Work: Caolan.McNamara at ul.ie          *  Phone: +353-61-202699
URL: http://www.csn.ul.ie/~caolan    *  Sig: an oblique strategy
Simple subtraction