RAR Password in 5 -15 minutes? Do you believe that?

This can be true in the case of very small archives and short passwords -
just after decompression a whole archive you can see, if you use right password -
so only very short archive can be unpacked in responsible time.

Originally Posted by Janus68

This can be true in the case of very small archives <...> -
just after decompression a whole archive you can see, if you use right password

Really? I don't think so.
File is being encrypted after it's compressed!
So when you are trying to decompress encrypted archive the sequence is smth like this:

1). Decrypt file/block with given password (or hash of password, or hash(hash(password)), etc);
2). Calculate hash of decrypted file/block; // I think WinRAR uses for this only few bytes from the beginning of the archive, may be one block
3). Compare with valid hash (that valid hash is calculated when file is being archived/encrypted);
4). If bad hash - "Wrong password!";
5). Else - decrypt other blocks and decompress decrypted file.

There is NO need to decompress or decrypt the WHOLE file to check if password is valid. One block is enough.
So there is no difference what is being bruteforced - tiny or huge archive.

BTW if you try to encrypt file before compressing it, that encrypted file will have very "bad" entropy and file compression ratio will be ~0% [ (decompressed_size - compressed_size) / decompressed_size ]

@Sten
Yes, this method really works! RSA-8192 or true AES-256 in few minutes

Originally Posted by cbs

There is NO need to decompress or decrypt the WHOLE file to check if password is valid. One block is enough.
So there is no difference what is being bruteforced - tiny or huge archive.

Wrong. There is no "blocks" - winrar compress whole file at once, and known checksum (crc32) is for whole uncompressed file too.
Ofcourse you can try bruteforce smaller file in archive, or try found "stored" (uncompressed, only encrypted) files, but if such files absent in arc? =)

[hosiminh]

@cbs

Lets find out if you statement is true ; here is small rar archive packed with Winrar 3.x (max. compression , solid archive +password (encrypt file names) (14 chars long , chars are numbers+small letters)

Give me what is inside and i will believe you.