There’s an embedded archive file called all.7z which contains thousands of additional emails and files.
The 7zip archiver in which this is stored uses 256 bit AES encryption. It’s a tough nut to crack.
“FOIA” chose this most likely because there are no effective tools for 7zip, while there seem to be many for standard .zip and .RAR files.
From their website: http://www.7-zip.org/7z.html
“7-Zip also supports encryption with AES-256 algorithm. This algorithm uses cipher key with length of 256 bits. To create that key 7-Zip uses derivation function based on SHA-256 hash algorithm. A key derivation function produces a derived key from text password defined by user. For increasing the cost of exhaustive search for passwords 7-Zip uses big number of iterations to produce cipher key from text password.”
The password can be 2047 or 8191 characters long, depending on your operating system.
I’m doubtful this password will be cracked anytime soon, maybe DoD could do it. Chances are that “FOIA” chose a very long password, that could take years to crack by a brute force attack.
“FOIA” is holding this in reserve, making it known that it is there, ready to pull the firing pin. I expect we’ll see it sooner than later as the reaction so far from RC and the Team is continued arrogance.
Julian Williams in Wales has an interesting take:
Maybe the passphrase is so complex to be uncrackable; is that possible? Surely after having sat on this material for two years FOIA would have made a decision how he is going to play this, and it just makes no sense to put most of the material behind a crackable passphrase.
But supposing he then sent the passphrase to Phil Jones and M Mann with a threat; Resign now, get the hell out, otherwise this passphrase goes online to the general public. That is a strategy that might push FOIA’s enemies out without completely disgracing the “scientific community”
Just another way of looking at what might motivate FOIA.
Discover more from Watts Up With That?
Subscribe to get the latest posts sent to your email.
JJThoms says:
November 24, 2011 at 4:55 am
Hmmm! Blackmail – thats a good one
===========
Or, how about – pay trillions of dollars in taxes to continue using fossil fuel or freeze to death?
Look people. Someone got a little excited when they entered “a miracle has happened” and the archived “appeared” to be unpacking. Nobody has cracked the password (that I know of). I just downloaded the archive and have tried different variations to no avail. However, there ARE a lot of variations to try – uppercase, lowercase, mixture of both, punctuation included/excluded, etc.
If any were successful we would have the documents by now! None of the people, who thought they unpacked it have reported back. Unless someone guesses the phrase, I suspect this lock will hold for some years. GK
@edvin
if I am understanding the architecture of 7z files yes the password in its hashed form is part of the zip file as an extra field appended to the header……….but the algorithm used to generate it is a one way process
you enter a password and an algorithm converts it to a hash and when you try to unzip the files the hashes are compared and if they match then the file will unzip and unencrypt
even with a hex editor and looking at the file and using lots of guesswork you won’t be breaking it, the hash might be encrypted too
http://en.wikipedia.org/wiki/ZIP_%28file_format%29
Btw: During one attempt to crack, one text file actually produced content ie a file size. When I opened it there was a few characters. I deleted the file before it occurred to me that it might be important. It was something like (sorry don’t know the symbol for cent) “cent cent cent cent ))]]”.
Has any one else been able to produce any characters (hence file size) in any unpacking attempts? Does it have any significance to crackers? GK
I’ve seen real miracles, things there was no way can be explained by Newtonian or Einsteinian physics. I’ve studied things like the First World War phenomenon called the Angel of Mons. I’ve looked at this from all sides, both naively believing, naively rejecting, and levels of maturity of both belief (with evidence) and rejection (with less evidence). Personally I try to steer clear of both belief and disbelief, I look for evidence, and I “believe” this puts me in the general mindset of scientific attitude.
The miracles I’ve seen and read up have a certain “feel” about them, I really cannot be too exact. They have a kind of deep integrity, simplicity, and direct usefulness, often lifesaving.
FOIA has all the attributes I associate with flat-out miracles.
My intuitive guess is that the password will be given to people in dreams, or something like that, when the time is right. Well, I wait to be proven wrong!
>>Q. Daniels says: November 23, 2011 at 11:06 am
>>Ralph,
>>I have what I promised our friend.
>>Thanks for the time.
Good news. Thanks.
.
The password is “Al Gore’s poop is green”
Could the protected files contain CRU’s raw data that it shared with the
World Bank and no one else?
220000 emails over 13.5 years means about 45 emails per day (~62 emails per working day).
Would that be expected amount of traffic for an organization of the size of CRU?
Analyzing the UNIX timestamps could give further information (week day frequency, notable events etc.).
I’m guessing:
– all.7z contains all the emails of the entire CRU staff between March 1996 and November 2009 (a dump from the email server) minus already published emails (FOIA2009 and FOIA2011 unencrypted).
– The reason to keep the passphrase secret is simply to protect the privacy of innocent people (staff not directly involved in climate science or under any FOI requests).
– Probably all “juicy” stuff has now been extracted using keyword searches and published.
– But just in case, as she/he/they haven’t read all 220000+ emails, the whole dump is released to “stand by” if there will be a reason for digging deeper into the pile.
jorgekafkazar says:
November 22, 2011 at 9:18 pm
The naivety of commenters here today is beyond idiot level.
crosspatch says: “Insurance against the person controlling the files being arrested or otherwise forcibly silenced. The key would be in the hands of a third party with instructions to post it should anything happen to the person controlling the file release. Maybe life insurance.”
That’s exactly it. The AGW scam is worth $US 100 billion. If certain parties figure out who the leaker is, he/she will be assassinated ASAP. The best protection is exactly what crosspatch has figured out. Do I need to also point out that cracking the encryption key and bragging about it here in public could cost someone his life? THIS IS NOT A GAME!
————–
Really???
Some people here have been watching way too many Hollywood conspiracy movies. Last I checked Julian Assange is still alive and fighting extradition to Sweden on a minor sex charge, although bumped off the news recently by Lindsey Lohan’s latest rehab setback. Odds are Lindsey will spend more time in jail than he will [unless she is sprung early by shadowy AGW supporters to star in a movie version of Al Gore’s “24 Hours of Climate Reality” …].
Does anyone really think the AGW crowd have more money, more trained agents, or more ability to carry out secret violence than the US diplomatic and intelligence agencies? Yet Julian is still roaming around the streets of London without armoured cars or Kevlar(tm) vests:
http://www.guardian.co.uk/media/2011/nov/15/julian-assange-extradition-wikileaks
Even Julian probably thinks speculations like the above are paranoid fantasies.
Really. It’s Thanksgiving and I’m going to increase my carbon footprint in a few hours by eating a big dinner. Then tomorrow I’m going to celebrate the start of the Christmas shopping season by joining an “Occupy Walmart” movement. Don’t let wild conspiracy fantasies spoil a perfectly good holiday.
My 7-zip opened something with 200,000 – odd files – all with 0 bytes content. Still took three crash-reboots of my Win7 computer before I could get it to the recycle bin, and even there, it took three minutes to remove.
I’ll leave this to the more technically-minded.
The password is most probably one of those sentences used in the ReadMe file. Otherwise, why include them? Try them all, and see which one unlocks the files.
(Yes, I’m a retired NCO, and yes, I’m sneaky and devious and bear watching.)
I’ve been going through the 7zip code and if anybody is interested then this is what it looks like it does when encrypting files.
1. Initialises the SHA256 digest
2. Adds a salt to the SHA256 digest
3. Adds a password to the SHA256 digest
4. adds an 8 byte number (zero to start with) to the SHA256 digest
5. increments the 8 byte number
6. Repeats 2-5 a total of 524288 times. (0x80000 in hex)
7. Compresses and encrypts the file using AES256 with the SHA256 digest as the password.
In the US, universities using PeopleSoft generally give “W numbers” to their students and staff, e.g. w012345 . . . if UEA uses PeopleSoft (which appears to be the case based on quick googling), perhaps the W number of one of the relevant CRU parties might be the key.
This could be the case whether or not “FOIA” 7zipped the file, as someone above speculated.
In any case, an orderly crowdsource of this would be worthwhile, if even in the form of a basic site where people could enter in guesses they’ve tried. However, the problem there would be AGW alarmists adding false data to throw people off.
It tends to be the case that governments have a number of clever cryptographers and powerful computers. If a government were to set its mind to opening this file – it might well succeed.
FOIA could be using the archive to send a message to only those he or she wants to read that message i.e. government. It will be interesting to see the general trajectory of governmental pronouncements post Climategate 2.0.
@ZT,
governments like to scare the people into thinking that their encrypted data can easily be cracked. This means people don’t bother to encrypt.
Unless you use an obvious password (eg an English word in lower case) and low level encryption your data is safe.
I’ve extracted enough code from 7zip to perform some benchmarking to determine how many passwords could be tested per second.
Using a quad core 2.4GHz processor I was able to generate 16 encryption keys (from passwords) per second. The reason this figure is so low is because the designers of 7zip made the key generation processor intensive.
If I had been able to get this figure to over 1000 per second then it would have been feasible to perform a dictionary attack. Because of this low number, and the low probability of success, I’m abandoning writing attack code for 7zip
To me the reason for placing the encrytped file out there is very simple: to be able to hide it in plain sight. By releasing the encrytped file like this:
1. They do not have to look after it as they can retrieve it at any time
2. They cannot be incriminated by being in possession of it on their computer as they can no download it post-facto from the internet
As for the password, it is unlikely to be a long, random number/character sequence as this could be misplaced and possession of the passphrase would be incriminating. I think there are two possibilities for the passphrase. One is that it is something that can be copied from plain view on the internet and that never changes. A text is therefore possible, but this might not be reliable enough as it must be something that is guaranteed to never change.
Alternatively the passphrase could be something that can be easily worked out if you just know the clue. For example, it could be a long number comprised of the first n primes written in sequence. You cannot forget it and you can very easily communicate this as a short message in a blog posting, or to a trusted person. Even a clue such as “primes n” would probably be sufficient for a crack to be run, even if they were in reverse order or some such as the number of permutations narrows down dramatically.
As an example, there are 95 primes between 1 and 500 and it just so happens they would give a sequence of 256 digits:
2357111317192329313741434753596167717379838997101103107109113127
1311371391491511571631671731791811911931971992112232272292332392
4125125726326927127728128329330731131331733133734734935335936737
3379383389397401409419421431433439443449457461463467479487491499
It only takes a few minutes to copy the list from the internet and reformat in a text editor to remove spaces. This sort of approach would make for a secure passwrod that cannot be lost and can be simply recovered.
I have figured out an unbreakable encryption. Its so easy that others have figured it out long ago, as a quick search on the Internet shows. If you are interested to learn more I found a some what good explanation here:
http://keithwiley.com/mindRamblings/unbreakableEncryption.shtml
Note, there are limitations to this method, as explained at the link.
42?
try
google
In the Readme file the following is one of few with a comment, could this be a hint;
One dollar can save a life — the opposite must also be true
Could the password be the reverse of OneDollar can save a life
efilaevasnacrallodenO
or variations on the above.
Just a thought, hope it helps
REPLY: Thanks, too simple vulnerable to password grinder attack – Anthony
Lots of speculation, wish the hot air was expended on cracking it.
Anthony is the General and I’ve appointed myself Regimental Sergeant-Major for a day or two to enforce some DISCIPLINE.
There is no way that the code as described can be cracked, especially by amateurs guessing. You have better things to do with your time. One of the better things is to contemplate the effect of Climategates 1 & 2 on the civilised world, particularly the way that the world regards Science.
Please read the emails if you think that you have the background, the skill and the experience to pull something useful from them. Then summarise that useful component, with recommendations about ways that could lessen the bad effects and enhance any good effects.
This is not material for children to play with. This is a revelation of a brutal attack on Science by a pack of people whose identities are still being uncovered. In the end, it would not surprise me to find that a cartel behind the Global Warming story was formed with the express purpose of making large capital gains, through schemes such as carbon trading. The main alternative hypothesis (in my mind at least) is a concern by some with power to try to cause a global wealth redistribution. Either way, the top weights are determined to find a place in history and they will not be easily stopped.
As a Scientist, my concern is with damage to the public perception of Science. Despite protestations by the players and despite whitewashes by a few inquirers, these email series show a side of Science that is alien to the genuine Scientist. John Citizen, however, could be pardoned for thinking that this is the crooked way that Science progresses normally.
Unless you are a geniune Scientist with a sense of history, you will not realize the enormous benefit that Science has brought to the World, to your personal health, to your personal comfort and enjoyment. You will know the fragility of a reputation and how it can be damaged by slinging mud, which is essentially the repetitive theme in Climategate. Sling mud at anyone who disagrees with you, stuff it in his/her mouth to cause silence.
My disapointment with the “me too” crowd of sycophants of man-made Global Warming personnel is high. When I first saw the makings of the man-made Global Warming scam, I hesitated not at all to add my full name and some not inconsiderable time to an investigation of it, though I lack the skills of a Steve McIntyre or an Anthony Watts and others who know who is on this list of achievers. I am really disapponted that more scientists have not had the guts to cross the line and add their criticism to the shallow nature of Global Warming “Science”.
So, troopers, forget the fun game of trying to invent uninventable passwords and get on with telling the public, the media, your friends, just how much of a sham this is. Guilt by omission to act is as bad guilt by commission. You would not like your name on the accused list of Climategate email people, so take positive steps to place the man-made Global Warming topic where it belongs – in the bin.
I’m not going to be much use in cracking this code. But I will make a guess on the contents:
In the zip will be….
5,000 emails and a slightly smaller encrypted zip. 🙂