A Study On Word Document Decryption Using Time-memory Trade-off Algorithm

As Microsoft Office documents are widely used in desktop systems, the security of these applications is widely concerned and considered by security keepers and also attackers home and abroad, Word document decryption is one of the hotspots in fields of security research. Traditional methods commonly use brute-force attack, However, as the length of encryption key grows, the search space increase accordingly, it's hard to achieve fully key space search in the effective period of time. Our research has centered about the cracking programme of encrypted Word document.Firstly, Office document file format and the binary structure of Word files are analyzed. In depth analysis of the Word document encryption mechanism and vulnerability that exists in the encryption mechanism, we propose a scheme, it can decrypt Word document in constant time and is independent of the length of password.Secondly, theory and implementation mechanism of time-memory trade-off algorithm are discussed and analyzed. On the base of absorbing their application ideas, a program for fast decrypt Word document is presented. Time-memory trade-off algorithm consists of two phases, it is a method for quickly inverting a one-way function using pre-computed tables. The pre-computation phase creating certain one-way chains iterating the one-way function, after which a digest of this exhaustive computation is stored, much smaller than complete dictionary. This table is used during the online phase to recover the pre-image of a given target, the time required is far less than exhaustive search. We apply it to the attack on Word document, based on rainbow table, we give a definition of a one-way function for cracking according to the encryption mechanism of Word document, then a time-memory trade-off algorithm suitable for Word document decryption was designed, we also give a detailed account of how to set optimal parameter, how to build rainbow tables and the search algorithm, using a number of running result to illustrate the solutions.Finally, MapReduce distributed programming model and its open-source implementation Hadoop framework is studied. In cognizance of precomputing table required a long time with single computer, the parallel implementation is designed to divide the workload for pre-computing tables across multiple nodes by introduction of MapReduce technologies, and precomputed tables are stored in Hadoop Distributed File System (HDFS), we design a time-memory trade-off cracking software which ground on MapReduce can be highly efficient and stable when running distributed tasks. Using distributed framework of Hadoop to build rainbow table, greatly reduce the building time and facilitate the management of rainbow table file, then using Hadoop cluster to search tainbow tables, the performance of cracking have further improved. On the study of Word document decryption, we combine attacks independent of password length with time-memory trade-off algorithm, then a model of Word document decryption is established. We also combine study model with practical application, take advantage of frontier technologies for distributed framework to meet project requirements well, the research fruits in this paper have referenced value and practical value in further cracking Word document.