SharpDevelop Community

Hi,

Refactoring of encryption to allow this kind of behaviour is still in progress.  So currently no work is being done on AES itself.  There are formatting issues to be compliant with WinZip/PKZIP formats as well as the raw encryption handling.

Cheers,

-jr-

Thank you for the excellent SharpZip lib, John.

I had a go at decrypting an AES-encrypted WinZip file.  Getting hold of the encrypted content stream was straightforward as the doco on the winzip site was correct, and the existing SharpZip code easy to modify.  I then tried using the RijndaelManaged class in .NET 2.0.  The problem is that WinZip are using AES in CTR mode (counter mode) but this is not a supported cipher mode in the RijndaelManaged library. 

 I may be noting something we all know, but I'll state it anyhow for the record for that volunteer who has the time to port the C code that WinZip uses to C#.

 WinZip's AES code (CTR mode) is based on C code written by Dr. Brian Gladman, and available with a BSD/GPL license from:

http://fp.gladman.plus.com/cryptography_technology/fileencrypt/ 

 It might be possible to use some of the code in the .NET framework and not port all of it.

You might also find some help over here:

http://www.bouncycastle.org/csharp/index.html 

They appear to be using an MIT X 11 license. 

They have 3 AES engines implemented in C# and Java, also based on Dr. Gladman's code:

http://www.bouncycastle.org/viewcvs/viewcvs.cgi/csharp/crypto/src/crypto/engines/AesEngine.cs 

 The November 2003 issue of MSDN magazine also had an article with code on implementing AES, I don't think it specifically implemented CTR mode, but it can be found at the Internet Archive at this url:

http://web.archive.org/web/20070825140924/http://msdn.microsoft.com/msdnmag/issues/03/11/AES/default.aspx 

Here is another article here:

http://madebits.com/articles/aes/index.php 

And an article describing what CTR mode is, as well as the other modes of block ciphers:

http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Counter_.28CTR.29 

 I'd love to help more, but that is all I've got time for today.

Done it!

This has only taken a year :-) but I have just successfully decrypted an AES-encrypted zip file.  

Have not yet tried creating a zipfile i.e. encrypting but I don't expect that to be a problem.

Still a couple of items to finish this off , e.g. the last block of 16 bytes needs special handling, but again that should not be too hard.

John, how would you prefer me to submit my code. ?

P.S. I have done most of this with one hand as I broke mu right hand in a painting scaffolding ladder accident. You don't want to know :-)

"This has only taken a year :-) but I have just successfully decrypted an AES-encrypted zip file."

 What every happened with this?

I would be interested in looking at the code in any state.

 First off my thanks for being interested in it. I really did not know if anyone would want it. What I have done is to gather my work and re-do my code against the current baseline. Cleaning up in the process as there was lots of experimental stuff. Redesigning to fit to the stream model. Then writing an encryption equivalent. 

 WhatI am currently working on is the supporting data fields that the file format requirs. These are essentially password and integrity checking hashes. My decrypt code did not check the password it just produces rubbish given the wrong password. This is normal for AES, the password checking is an extra. For both decryption and encryption  I am working on generating these extra fields as part of the process. It's not clear yet in Dr Brian Gladman's code where these derive from and nor are they obvious from the .net crypto library. I just need some clear time to look at it. 

We are coming to the end of a massive amount of work here towards our annual US conference and demonstrations. I have just had no time this last month or so. Coding complete cutoff is just 2 weeks away so I will be at it asap. 

Again thanks and will report back 

David

Hi David,

I'm wondering if you have developments on the AES front? I'm also interested in participating/helping with the release of this feature.

Regards, Ivan

I have posted a beta version of my AES code onto the web for anyone interested.
This will do decryption and encryption in AES format that agrees with WinZip in either 128 or 256 bit. I was lucky enough to get two solid days to work on it with a colleague to get the encryption working.

The 7 files in the archive should be applied against SharpZip version 0855.

There is also a sample showing how to use it, in AESSample.cs

Please note -- I have only tried the methods in that sample: i.e. ZipOutputStream to create, and ZipFile to extract. It is quite likely that the alternative classes such as creating with ZipFile or extracting with ZipInputStream may not work yet. There is some duplication in the code particularly around entry writing. I will have a look at that soon.

That aside, the only known problem is that password verification on extract is not there yet. Edit: This is now working in the 20090616 version see next post.  If you try the wrong password in SharpZipLib you get gibberish out. Again, not a big problem that should be fixed soon. Works fine in Winzip.

You can download the beta (from my wife's website, the easiest place for me to post to)

http://www.blissfloral.com.au/ref/AES-20090609.zip
(Obsolete, see next post)

Regards
David

Password verification is now working. New version available at

http://www.blissfloral.com.au/ref/AES-20090616.zip

The ZipFile.cs has been updated.

Extracting with ZipInputStream does not work yet. This is not as easy as I might have hoped because it will require inserting the AESStreamReader into the InflaterInputStream before the CryptoTransform. Structurally a bit challenging.