I am studying the way that can be used to check if a given password for an encrypted zip file is correct or not. I see this link:

How does a zip file detect a correct password?

In the answer of this question, it said CRC is used to check if a password is correct. It also paste a code snippet from Info-zip to prove this.

However, after carefully studying the Info-zip source code, as below:

    if ((ush)(c | (b<<8)) != (GLOBAL(pInfo->ExtLocHdr) ?
                           ((ush)GLOBAL(lrec.last_mod_dos_datetime) & 0xffff) :
                           (ush)(GLOBAL(lrec.crc32) >> 16)))

I find when there is ExtLocHdr in the zip item, the lower 2 bytes of last_mod_dos_datetime, instead of the CRC, will be used to verify the password. But this is not mentioned in the file format specification in https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT at all.


  • I'm not sure this has anything to do with security. This is either a coding question or a reverse engineering question. This is a "how does this program work?" question. You might want to use the answer to make your own bruteforcer, but that doesn't make this a security question.
    – schroeder
    Apr 23, 2020 at 8:29
  • @schroeder, Thank you. I ask in security site since the post I mentioned is also posted on security site, i.e., security.stackexchange.com/questions/199545/…
    – alancc
    Apr 23, 2020 at 9:35


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.