Sample Header Ad - 728x90

How does 7z implement AES encryption?

1 vote
0 answers
113 views
**Questions:** * Which AES algorithm mode is used in 7z? (Is it ECB, CBC, CFB, OFB, or CTR?) * When executing the command 7z a ArchiveName SomeDir -p, how does 7z perform encryption? Does it treat all data as a single solid file, or does it encrypt files individually, or maybe it creates blocks of a specific size for encryption? * If 7z uses data-blocks, how are these blocks created and what is their size? * How does 7z validate a password during decryption? Like, when it displays ERROR: Wrong password?, how does it deduce that the password is incorrect? Does it add certain headers before encryption or something? * Does 7z arrange files in alphabetical order for encryption/archiving when using the command 7z a ArchiveName SomeDir -p? **Motivation:** I managed to recover a deleted 7z archive (see this question for more details). The archive was password-protected and contained 17 sub-archives, all in 7z format. I managed to decrypt and extract 14 of them, but three of them remain inaccessible (_one of these three "B.7z" is 90% decrypted/decompressed but lacks the final block, including file names and sizes_). I guess the data-blocks (?) for these files may be corrupted. Here are some additional details about the archive:
7-Zip  16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,8 CPUs Intel(R) Core(TM) i5-8250U CPU @ 1.60GHz (806EA),ASM,AES-NI)

Scanning the drive for archives:
1 file, 125245022698 bytes (117 GiB)

Listing archive: Archive.7z

--
Path = Archive.7z
Type = 7z
Physical Size = 125245022698
Headers Size = 890
Method = LZMA2:24 7zAES
Solid = -
Blocks = 17

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2024-07-31 00:58:29 D....            0            0  DirName
2023-12-19 05:09:59 ....A    709350805    709388448  DirName/A.7z
2024-07-31 00:01:33 ....A   1586475200   1586559392  DirName/B.7z
2024-02-16 05:23:20 ....A   5813424658   5813733152  DirName/C.7z
2023-11-14 21:52:41 ....A  25460362975  25461713984  DirName/D.7z
2023-11-14 22:19:30 ....A   1713616561   1713707504  DirName/E.7z
2023-12-19 03:45:36 ....A  10539749018  10540308304  DirName/F.7z
2023-12-27 05:36:51 ....A   3637788779   3637981824  DirName/G.7z
2024-02-27 04:20:54 ....A   2566526729   2566662928  DirName/H.7z
2024-03-21 04:59:37 ....A   1180988362   1181051040  DirName/I.7z
2024-03-19 06:42:05 ....A   3751427829   3751626896  DirName/J.7z
2023-08-28 13:37:06 ....A  22618868536  22620068768  DirName/K.7z
2024-01-28 16:44:37 ....A   2768329573   2768476480  DirName/L.7z
2023-09-26 03:42:19 ....A  12245436464  12246086256  DirName/M.7z
2023-09-07 07:34:45 ....A   8162568245   8163001392  DirName/N.7z
2024-02-24 04:26:55 ....A   3300729037   3300904192  DirName/O.7z
2024-03-27 03:32:53 ....A   4387445171   4387677984  DirName/P.7z
2023-07-02 06:10:47 ....A  14795288170  14796073264  DirName/Q.7z
------------------- ----- ------------ ------------  ------------------------
2024-07-31 00:58:29       125238376112 125245021808  17 files, 1 folders
###########################
# ERRORS WHEN EXTRACTING:
###########################

ERROR: Data Error in encrypted file. Wrong password? : DirName/B.7z
ERROR: Data Error in encrypted file. Wrong password? : DirName/C.7z
ERROR: Data Error in encrypted file. Wrong password? : DirName/D.7z
Considering that each of these sub-7z files has a constant signature (Magic number + some flags: 37 7a bc af 27 1c 00 04), and knowing the password allows us to calculate its SHA-256 value for AES, is it possible to implement a reverse approach to recover the damaged parts? Also, if I am certain that the corruption is within the first 8 GB of the file, can I decrypt/decompress some segments of DirName/D.7z? I would greatly appreciate any guidance on recovering the damaged sections. I apologize for the lengthy and detailed question, and I would also appreciate any references for further reading.
Asked by behrad (31 rep)
Sep 5, 2024, 08:19 PM