WebSVN – decoder – Blame – /trunk/Private/dc4-spec.txt

Rev	Author	Line No.	Line
14	daniel-mar	1	=============================
		2	DC4 FILE FORMAT SPECIFICATION
		3	=============================
		4
		5	Type: Encrypted file
		6	Contents: Binary information
		7	Used by: ViaThinkSoft (De)Coder 4.0
		8	ViaThinkSoft (De)Coder 4.1
		9	Author: Daniel Marschall
20	daniel-mar	10	Last update: April, 30th 2024
14	daniel-mar	11
		12
		13	CONTENTS
		14	========
		15
		16	[1.0] Sample file-format by Hagen Reddmann
		17
		18	[2.0] DC4 Standard 1 used by (De)Coder 4.0
		19
		20	[3.0] DC4 Standard 2 used by (De)Coder 4.1 Beta
		21
15	daniel-mar	22	[4.0] DC4 Standard 3 used by (De)Coder 4.1 Final/Cancelled
14	daniel-mar	23
19	daniel-mar	24	[5.0] DC4 Standard 3 used by (De)Coder 5.0
		25
20	daniel-mar	26	[APP A] Comments
14	daniel-mar	27	* Links to websites
		28
		29
		30	[1.0] SAMPLE FILE-FORMAT BY HAGEN REDDMANN
		31	==========================================
		32
		33	This file format is NOT used by (De)Coder.
		34	It is only the guideline of the DC4-Format.
		35	Hagen Reddmann posted the demo-algorithm in this topic:
27	daniel-mar	36	https://www.delphipraxis.net/66783-sichere-verschluesselung-von-dateien-mit-dem-dec-5-1-a.html (in German)
14	daniel-mar	37
15	daniel-mar	38	---------------------------------------------------------------------------------------------------
14	daniel-mar	39	Offset Type Size Content/Description
		40	---------------------------------------------------------------------------------------------------
15	daniel-mar	41	00h Long 4 DEC 5.1c Cipher idendity with identity-base 0x84485225
20	daniel-mar	42	0x51F07042 TCipher_Blowfish (KeySize: 56, BlockSize: 8, BufferSize: 8)
		43	0xB6936130 TCipher_Twofish (KeySize: 32, BlockSize: 16, BufferSize: 16)
		44	0x3C212341 TCipher_IDEA (KeySize: 16, BlockSize: 8, BufferSize: 8)
		45	0x42DBD0CA TCipher_Cast256 (KeySize: 32, BlockSize: 16, BufferSize: 16)
		46	0x43B28323 TCipher_Mars (KeySize: 56, BlockSize: 16, BufferSize: 16)
		47	0x76BA0D8C TCipher_RC4 (KeySize: 256, BlockSize: 1, BufferSize: 16)
		48	0x98B46CA0 TCipher_RC6 (KeySize: 256, BlockSize: 16, BufferSize: 16)
		49	0xFDA1E273 TCipher_Rijndael (KeySize: 32, BlockSize: 16, BufferSize: 16, default)
		50	0x2C4D11CF TCipher_Square (KeySize: 16, BlockSize: 16, BufferSize: 16)
21	daniel-mar	51	0x96954A47 TCipher_SCOP (KeySize: 48, BlockSize: 4, BufferSize: 32, faulty implementation)
20	daniel-mar	52	0x47E376A6 TCipher_Sapphire(KeySize: 1024, BlockSize: 1, BufferSize: 32)
		53	0x6113DA7A TCipher_1DES (KeySize: 8, BlockSize: 8, BufferSize: 8)
		54	0x73A67594 TCipher_2DES (KeySize: 16, BlockSize: 8, BufferSize: 8)
		55	0xCB1A12F1 TCipher_3DES (KeySize: 24, BlockSize: 8, BufferSize: 8)
		56	0x75D8876B TCipher_2DDES (KeySize: 16, BlockSize: 16, BufferSize: 16)
		57	0x48B8AEDB TCipher_3DDES (KeySize: 24, BlockSize: 16, BufferSize: 16)
		58	0x18A1F944 TCipher_3TDES (KeySize: 24, BlockSize: 24, BufferSize: 24)
		59	0x51C323C2 TCipher_3Way (KeySize: 12, BlockSize: 12, BufferSize: 12)
		60	0xE864D553 TCipher_Cast128 (KeySize: 16, BlockSize: 8, BufferSize: 8)
		61	0xA1EEEAAF TCipher_Gost (KeySize: 32, BlockSize: 8, BufferSize: 8)
		62	0x56555753 TCipher_Misty (KeySize: 16, BlockSize: 8, BufferSize: 8)
		63	0x5BF00A6F TCipher_NewDES (KeySize: 15, BlockSize: 8, BufferSize: 8)
		64	0xB211D023 TCipher_Q128 (KeySize: 16, BlockSize: 16, BufferSize: 16)
		65	0x9FD9A8B9 TCipher_RC2 (KeySize: 128, BlockSize: 8, BufferSize: 8)
		66	0x01BD3D1A TCipher_RC5 (KeySize: 256, BlockSize: 8, BufferSize: 8)
		67	0x92D7CD5C TCipher_SAFER (KeySize: 16, BlockSize: 8, BufferSize: 8)
21	daniel-mar	68	0x8B78B805 TCipher_Shark (KeySize: 16, BlockSize: 8, BufferSize: 8, faulty implementation)
20	daniel-mar	69	0xD731ED9F TCipher_Skipjack (KeySize: 10, BlockSize: 8, BufferSize: 8)
		70	0x0402530B TCipher_TEA (KeySize: 16, BlockSize: 8, BufferSize: 8)
		71	0x6B431EA1 TCipher_TEAN (KeySize: 16, BlockSize: 8, BufferSize: 8)
15	daniel-mar	72	04h Byte 1 DEC 5.1c Cipher mode
20	daniel-mar	73	0x00 CTSx double CBC, with CFS8 padding of truncated final block (default, proprietary to DEC)
		74	0x01 CBCx Cipher Block Chainung, with CFB8 padding of truncated final block
		75	0x02 CFB8 8bit Cipher Feedback mode
		76	0x03 CFBx CFB on Blocksize of Cipher
		77	0x04 OFB8 8bit Output Feedback mode
		78	0x05 OFBx OFB on Blocksize bytes
		79	0x06 CFS8 8Bit CFS, double CFB
		80	0x07 CFSx CFS on Blocksize bytes
		81	0x08 ECBx Electronic Code Book (CalcMAC not possible)
15	daniel-mar	82	05h Long 4 DEC 5.1c Hash-Idendity with identity-base 0x84485225.
20	daniel-mar	83	0xD6B9FFD9 THash_MD2 (DigestSize: 16, BlockSize: 16)
		84	0x3FDA5AEC THash_MD4 (DigestSize: 16, BlockSize: 64)
		85	0x48DD6A7A THash_MD5 (DigestSize: 16, BlockSize: 64)
		86	0xA5B81E29 THash_SHA (DigestSize: 20, BlockSize: 64)
		87	0x7E3889A5 THash_SHA1 (DigestSize: 20, BlockSize: 64, default)
		88	0x9BFE22E7 THash_SHA256 (DigestSize: 32, BlockSize: 64)
		89	0xC19C57B1 THash_SHA384 (DigestSize: 48, BlockSize: 128)
		90	0xFDB0357F THash_SHA512 (DigestSize: 64, BlockSize: 128, default)
		91	0x815B1495 THash_Sapphire (DigestSize: 64, BlockSize: 1)
		92	0x3729E306 THash_Panama (DigestSize: 32, BlockSize: 32)
		93	0x0B148DEE THash_Tiger (DigestSize: 24, BlockSize: 64)
		94	0x42F77C97 THash_RipeMD128 (DigestSize: 16, BlockSize: 64)
		95	0x284031A1 THash_RipeMD160 (DigestSize: 20, BlockSize: 64)
		96	0xE848790E THash_RipeMD256 (DigestSize: 32, BlockSize: 64)
		97	0x4FA820CB THash_RipeMD320 (DigestSize: 40, BlockSize: 64)
		98	0xB59AAC5E THash_Haval128 (DigestSize: 16, BlockSize: 128)
		99	0xDF2DE168 THash_Haval160 (DigestSize: 20, BlockSize: 128)
		100	0xB6BB9C8B THash_Haval192 (DigestSize: 24, BlockSize: 128)
		101	0xBE6A5E2C THash_Haval224 (DigestSize: 28, BlockSize: 128)
		102	0x1F25A9C7 THash_Haval256 (DigestSize: 32, BlockSize: 128)
		103	0x59D2CCC4 THash_Whirlpool (DigestSize: 64, BlockSize: 64)
		104	0xA07F7DB2 THash_Whirlpool1 (DigestSize: 64, BlockSize: 64)
		105	0x9C721C33 THash_Square (DigestSize: 16, BlockSize: 16)
		106	0xE62E90A3 THash_Snefru128 (DigestSize: 16, BlockSize: 48)
		107	0x4C91953A THash_Snefru256 (DigestSize: 32, BlockSize: 32)
15	daniel-mar	108	09h Byte 1 Size of seed (Default value: 16 Bytes)
		109	0Ah Binary 0-255 Seed (Random data)
		110	Long 4 Size of data
20	daniel-mar	111	Binary var DEC 5.1c encrypted data; Password = Hash->KDfx(User-Password, Seed); KDFx is proprietary to DEC
15	daniel-mar	112	Byte 1 Size of CalcMAC
27	daniel-mar	113	Binary 0-255 DEC "CalcMAC"; Size depends on cipher algorithm and cipher mode. The algorithms of DEC give out CalcMAC with the length 16-64.
14	daniel-mar	114	---------------------------------------------------------------------------------------------------
		115
		116
		117	[2.0] DC4 STANDARD 1 USED BY (DE)CODER 4.0
		118	==========================================
		119
		120	This file format is used by (De)Coder 4.0
15	daniel-mar	121	The Idendity-Base of this file format is 0x59178954 (but identities are not used).
14	daniel-mar	122
15	daniel-mar	123	---------------------------------------------------------------------------------------------------
14	daniel-mar	124	Offset Type Size Content/Description
		125	---------------------------------------------------------------------------------------------------
15	daniel-mar	126	00h Byte 1 Compress mode flag
		127	00h: Uncompressed file - Default in (De)Coder 4.0
		128	01h: Folder compressed with ZIP - Default in (De)Coder 4.0
		129	01h Byte 1 Version flag; Hardcoded value: 01h.
22	daniel-mar	130	02h String var Original file name, ANSI encoded
15	daniel-mar	131	Byte 1 Terminus Value: 1Fh ("?")
20	daniel-mar	132	Binary 16 Seed (Random data. Default size: 16 bytes = 0x10
		133	Binary var DEC 5.1c encrypted data (read until file end minus the size of the checksum)
		134	Password: Hash->KDfx(User-Password, Seed); KDFx is proprietary to DEC
15	daniel-mar	135	Algorithm: RIJNDAEL (AES)
20	daniel-mar	136	Mode: CTSx (proprietary to DEC)
15	daniel-mar	137	Binary var Checksum of the data before encryption
14	daniel-mar	138	Default hash configuration
		139	Algorithm: SHA 512
23	daniel-mar	140	Size dependend on the hash algorithm (DigestSize).
14	daniel-mar	141	The algorithms of DEC give out a hash with the length 16-64.
15	daniel-mar	142	---------------------------------------------------------------------------------------------------
14	daniel-mar	143
		144
		145	[3.0] DC4 STANDARD 2 USED BY (DE)CODER 4.1 BETA
		146	===============================================
		147
		148	This file format is used by (De)Coder 4.1 Public Beta 1 through (De)Coder 4.1 Public Beta 4b.
		149
15	daniel-mar	150	---------------------------------------------------------------------------------------------------
14	daniel-mar	151	Offset Type Size Content/Description
		152	---------------------------------------------------------------------------------------------------
15	daniel-mar	153	00h Byte 1 Compress mode flag
		154	00h: Uncompressed file
		155	01h: Folder compressed with ZIP
		156	02h: ZLib-compressed file - Default in (De)Coder 4.1
		157	03h: ZLib-compressed folder, packed ZIP - Default in (De)Coder 4.1
		158	01h Byte 1 Version flag; Hardcoded value: 02h
22	daniel-mar	159	02h Binary var Original file name, ANSI encoded, in BASE64 (binary)
15	daniel-mar	160	Byte 1 Terminus Value: 1Fh ("?")
		161	Long 4 DEC 5.1c Idendity-Base; Default 0x84671842
		162	Long 4 DEC 5.1c Cipher idendity. If the default identitiy base 0x84671842 is used, then the identities are:
20	daniel-mar	163	0xFAD52117 TCipher_Blowfish (KeySize: 56, BlockSize: 8, BufferSize: 8)
		164	0x1DB63065 TCipher_Twofish (KeySize: 32, BlockSize: 16, BufferSize: 16)
		165	0x97047214 TCipher_IDEA (KeySize: 16, BlockSize: 8, BufferSize: 8)
		166	0xE9FE819F TCipher_Cast256 (KeySize: 32, BlockSize: 16, BufferSize: 16)
		167	0xE897D276 TCipher_Mars (KeySize: 56, BlockSize: 16, BufferSize: 16)
		168	0xDD9F5CD9 TCipher_RC4 (KeySize: 256, BlockSize: 1, BufferSize: 16)
		169	0x33913DF5 TCipher_RC6 (KeySize: 256, BlockSize: 16, BufferSize: 16)
		170	0x5684B326 TCipher_Rijndael (KeySize: 32, BlockSize: 16, BufferSize: 16, default)
		171	0x8768409A TCipher_Square (KeySize: 16, BlockSize: 16, BufferSize: 16)
21	daniel-mar	172	0x3DB01B12 TCipher_SCOP (KeySize: 48, BlockSize: 4, BufferSize: 32, faulty implementation)
20	daniel-mar	173	0xECC627F3 TCipher_Sapphire(KeySize: 1024, BlockSize: 1, BufferSize: 32)
		174	0xCA368B2F TCipher_1DES (KeySize: 8, BlockSize: 8, BufferSize: 8)
		175	0xD88324C1 TCipher_2DES (KeySize: 16, BlockSize: 8, BufferSize: 8)
		176	0x603F43A4 TCipher_3DES (KeySize: 24, BlockSize: 8, BufferSize: 8)
		177	0xDEFDD63E TCipher_2DDES (KeySize: 16, BlockSize: 16, BufferSize: 16)
		178	0xE39DFF8E TCipher_3DDES (KeySize: 24, BlockSize: 16, BufferSize: 16)
		179	0xB384A811 TCipher_3TDES (KeySize: 24, BlockSize: 24, BufferSize: 24)
		180	0xFAE67297 TCipher_3Way (KeySize: 12, BlockSize: 12, BufferSize: 12)
		181	0x43418406 TCipher_Cast128 (KeySize: 16, BlockSize: 8, BufferSize: 8)
		182	0x0ACBBBFA TCipher_Gost (KeySize: 32, BlockSize: 8, BufferSize: 8)
		183	0xFD700606 TCipher_Misty (KeySize: 16, BlockSize: 8, BufferSize: 8)
		184	0xF0D55B3A TCipher_NewDES (KeySize: 15, BlockSize: 8, BufferSize: 8)
		185	0x19348176 TCipher_Q128 (KeySize: 16, BlockSize: 16, BufferSize: 16)
		186	0x34FCF9EC TCipher_RC2 (KeySize: 128, BlockSize: 8, BufferSize: 8)
		187	0xAA986C4F TCipher_RC5 (KeySize: 256, BlockSize: 8, BufferSize: 8)
		188	0x39F29C09 TCipher_SAFER (KeySize: 16, BlockSize: 8, BufferSize: 8)
21	daniel-mar	189	0x205DE950 TCipher_Shark (KeySize: 16, BlockSize: 8, BufferSize: 8, faulty implementation)
20	daniel-mar	190	0x7C14BCCA TCipher_Skipjack (KeySize: 10, BlockSize: 8, BufferSize: 8)
		191	0xAF27025E TCipher_TEA (KeySize: 16, BlockSize: 8, BufferSize: 8)
		192	0xC0664FF4 TCipher_TEAN (KeySize: 16, BlockSize: 8, BufferSize: 8)
		193	Byte 1 DEC 5.1c Cipher mode
		194	0x00 CTSx double CBC, with CFS8 padding of truncated final block (default, proprietary to DEC)
19	daniel-mar	195	0x01 CBCx Cipher Block Chainung, with CFB8 padding of truncated final block
		196	0x02 CFB8 8bit Cipher Feedback mode
		197	0x03 CFBx CFB on Blocksize of Cipher
		198	0x04 OFB8 8bit Output Feedback mode
		199	0x05 OFBx OFB on Blocksize bytes
		200	0x06 CFS8 8Bit CFS, double CFB
		201	0x07 CFSx CFS on Blocksize bytes
20	daniel-mar	202	0x08 ECBx Electronic Code Book (CalcMAC not possible)
15	daniel-mar	203	Long 4 DEC 5.1c Hash idendity. If the default identitiy base 0x84671842 is used, then the identities are:
20	daniel-mar	204	0x7D9CAE8C THash_MD2 (DigestSize: 16, BlockSize: 16)
		205	0x94FF0BB9 THash_MD4 (DigestSize: 16, BlockSize: 64)
		206	0xE3F83B2F THash_MD5 (DigestSize: 16, BlockSize: 64)
		207	0x0E9D4F7C THash_SHA (DigestSize: 20, BlockSize: 64)
		208	0xD51DD8F0 THash_SHA1 (DigestSize: 20, BlockSize: 64)
		209	0x30DB73B2 THash_SHA256 (DigestSize: 32, BlockSize: 64)
		210	0x6AB906E4 THash_SHA384 (DigestSize: 48, BlockSize: 128)
		211	0x5695642A THash_SHA512 (DigestSize: 64, BlockSize: 128, default)
		212	0x2A7E45C0 THash_Sapphire (DigestSize: 64, BlockSize: 1)
		213	0x9C0CB253 THash_Panama (DigestSize: 32, BlockSize: 32)
		214	0xA031DCBB THash_Tiger (DigestSize: 24, BlockSize: 64)
		215	0xE9D22DC2 THash_RipeMD128 (DigestSize: 16, BlockSize: 64)
		216	0x836560F4 THash_RipeMD160 (DigestSize: 20, BlockSize: 64)
		217	0x436D285B THash_RipeMD256 (DigestSize: 32, BlockSize: 64)
		218	0xE48D719E THash_RipeMD320 (DigestSize: 40, BlockSize: 64)
		219	0x1EBFFD0B THash_Haval128 (DigestSize: 16, BlockSize: 128)
		220	0x7408B03D THash_Haval160 (DigestSize: 20, BlockSize: 128)
		221	0x1D9ECDDE THash_Haval192 (DigestSize: 24, BlockSize: 128)
		222	0x154F0F79 THash_Haval224 (DigestSize: 28, BlockSize: 128)
		223	0xB400F892 THash_Haval256 (DigestSize: 32, BlockSize: 128)
		224	0xF2F79D91 THash_Whirlpool (DigestSize: 64, BlockSize: 64)
		225	0x0B5A2CE7 THash_Whirlpool1 (DigestSize: 64, BlockSize: 64)
		226	0x37574D66 THash_Square (DigestSize: 16, BlockSize: 16)
		227	0x4D0BC1F6 THash_Snefru128 (DigestSize: 16, BlockSize: 48)
		228	0xE7B4C46F THash_Snefru256 (DigestSize: 32, BlockSize: 32)
15	daniel-mar	229	Byte 1 Size of seed; Default value: 32 byte
		230	Binary 0-255 Seed (Random data)
20	daniel-mar	231	Binary var With DEC 5.1c encrypted data, encrypted with password (read until file end minus the size of the checksum and the file terminus)
		232	Password = Hash->KDfx(User-Password, Seed); KDFx is proprietary to DEC
15	daniel-mar	233	Binary var Secured checksum of the data before encryption
		234	= Hash(Hash(Original Data) & Seed & User-Password)
23	daniel-mar	235	Size dependend on the hash algorithm (DigestSize).
15	daniel-mar	236	The algorithms of DEC give out a hash with the length 16-64.
19	daniel-mar	237	Binary 16 DC4-Terminus; Hardcoded value: "RENURVJNSU5VUw==" (BASE64: "DCTERMINUS")
14	daniel-mar	238	---------------------------------------------------------------------------------------------------
		239
		240
15	daniel-mar	241	[4.0] DC4 STANDARD 3 USED BY (DE)CODER 4.1 (CANCELLED)
		242	======================================================
14	daniel-mar	243
15	daniel-mar	244	This file format was intended to be used by the final version of (De)Coder 4.1, which was never finished and never released.
14	daniel-mar	245
		246	---------------------------------------------------------------------------------------------------
		247	Offset Type Size Content/Description
		248	---------------------------------------------------------------------------------------------------
15	daniel-mar	249	00h Byte 1 Compress mode flag
		250	00h: Uncompressed file
		251	01h: Folder compressed with ZIP
		252	02h: ZLib-compressed file - Default in (De)Coder 4.1
		253	03h: ZLib-compressed folder, packed ZIP - Default in (De)Coder 4.1
		254	01h Byte 1 Version flag; Hardcoded value: 03h
14	daniel-mar	255	02h Byte 1 Filename encrypted with User-Password?
15	daniel-mar	256	00h: No
		257	01h: Yes
25	daniel-mar	258	03h Long 4 Size (in bytes) of the encrypted filename that follows
		259	07h Binary var Original file name, not null-terminated WideString (UTF-16)
19	daniel-mar	260	Encrypted with DEC 5.1c (cipher/hash see below)
14	daniel-mar	261	If offset 02h of this part has the value 00h:
15	daniel-mar	262	Encryption-Password = Hash->KDfx(5Eh D1h 6Bh 12h 7Dh B4h C4h 3Ch, Seed)
		263	If offset 02h of this part has the value 01h:
		264	Encryption-Password = Hash->KDfx(User-Password, Seed)
20	daniel-mar	265	KDFx is proprietary to DEC
15	daniel-mar	266	Long 4 DEC 5.1c Idendity-Base; Default Idendity-Base: 0x19387612
		267	Long 4 DEC 5.1c Cipher idendity. If the default identitiy base 0x84671842 is used, then the identities are:
20	daniel-mar	268	0xEC871D7C TCipher_Blowfish (KeySize: 56, BlockSize: 8, BufferSize: 8)
		269	0x0BE40C0E TCipher_Twofish (KeySize: 32, BlockSize: 16, BufferSize: 16)
		270	0x81564E7F TCipher_IDEA (KeySize: 16, BlockSize: 8, BufferSize: 8)
		271	0xFFACBDF4 TCipher_Cast256 (KeySize: 32, BlockSize: 16, BufferSize: 16)
		272	0xFEC5EE1D TCipher_Mars (KeySize: 56, BlockSize: 16, BufferSize: 16)
		273	0xCBCD60B2 TCipher_RC4 (KeySize: 256, BlockSize: 1, BufferSize: 16)
		274	0x25C3019E TCipher_RC6 (KeySize: 256, BlockSize: 16, BufferSize: 16)
		275	0x40D68F4D TCipher_Rijndael (KeySize: 32, BlockSize: 16, BufferSize: 16, default)
		276	0x913A7CF1 TCipher_Square (KeySize: 16, BlockSize: 16, BufferSize: 16)
21	daniel-mar	277	0x2BE22779 TCipher_SCOP (KeySize: 48, BlockSize: 4, BufferSize: 32, faulty implementation)
20	daniel-mar	278	0xFA941B98 TCipher_Sapphire(KeySize: 1024, BlockSize: 1, BufferSize: 32)
		279	0xDC64B744 TCipher_1DES (KeySize: 8, BlockSize: 8, BufferSize: 8)
		280	0xCED118AA TCipher_2DES (KeySize: 16, BlockSize: 8, BufferSize: 8)
		281	0x766D7FCF TCipher_3DES (KeySize: 24, BlockSize: 8, BufferSize: 8)
		282	0xC8AFEA55 TCipher_2DDES (KeySize: 16, BlockSize: 16, BufferSize: 16)
		283	0xF5CFC3E5 TCipher_3DDES (KeySize: 24, BlockSize: 16, BufferSize: 16)
		284	0xA5D6947A TCipher_3TDES (KeySize: 24, BlockSize: 24, BufferSize: 24)
		285	0xECB44EFC TCipher_3Way (KeySize: 12, BlockSize: 12, BufferSize: 12)
		286	0x5513B86D TCipher_Cast128 (KeySize: 16, BlockSize: 8, BufferSize: 8)
		287	0x1C998791 TCipher_Gost (KeySize: 32, BlockSize: 8, BufferSize: 8)
		288	0xEB223A6D TCipher_Misty (KeySize: 16, BlockSize: 8, BufferSize: 8)
		289	0xE6876751 TCipher_NewDES (KeySize: 15, BlockSize: 8, BufferSize: 8)
		290	0x0F66BD1D TCipher_Q128 (KeySize: 16, BlockSize: 16, BufferSize: 16)
		291	0x22AEC587 TCipher_RC2 (KeySize: 128, BlockSize: 8, BufferSize: 8)
		292	0xBCCA5024 TCipher_RC5 (KeySize: 256, BlockSize: 8, BufferSize: 8)
		293	0x2FA0A062 TCipher_SAFER (KeySize: 16, BlockSize: 8, BufferSize: 8)
21	daniel-mar	294	0x360FD53B TCipher_Shark (KeySize: 16, BlockSize: 8, BufferSize: 8, faulty implementation)
20	daniel-mar	295	0x6A4680A1 TCipher_Skipjack (KeySize: 10, BlockSize: 8, BufferSize: 8)
		296	0xB9753E35 TCipher_TEA (KeySize: 16, BlockSize: 8, BufferSize: 8)
		297	0xD634739F TCipher_TEAN (KeySize: 16, BlockSize: 8, BufferSize: 8)
		298	Byte 1 DEC 5.1c Cipher mode
		299	0x00 CTSx double CBC, with CFS8 padding of truncated final block (default, proprietary to DEC)
19	daniel-mar	300	0x01 CBCx Cipher Block Chainung, with CFB8 padding of truncated final block
		301	0x02 CFB8 8bit Cipher Feedback mode
		302	0x03 CFBx CFB on Blocksize of Cipher
		303	0x04 OFB8 8bit Output Feedback mode
		304	0x05 OFBx OFB on Blocksize bytes
		305	0x06 CFS8 8Bit CFS, double CFB
		306	0x07 CFSx CFS on Blocksize bytes
20	daniel-mar	307	0x08 ECBx Electronic Code Book (CalcMAC not possible)
19	daniel-mar	308	Long 4 DEC 5.1c Hash idendity. If the default identitiy base 0x84671842 is used, then the identities are:
20	daniel-mar	309	0x6BCE92E7 THash_MD2 (DigestSize: 16, BlockSize: 16)
		310	0x82AD37D2 THash_MD4 (DigestSize: 16, BlockSize: 64)
		311	0xF5AA0744 THash_MD5 (DigestSize: 16, BlockSize: 64)
		312	0x18CF7317 THash_SHA (DigestSize: 20, BlockSize: 64)
		313	0xC34FE49B THash_SHA1 (DigestSize: 20, BlockSize: 64)
		314	0x26894FD9 THash_SHA256 (DigestSize: 32, BlockSize: 64)
		315	0x7CEB3A8F THash_SHA384 (DigestSize: 48, BlockSize: 128)
		316	0x40C75841 THash_SHA512 (DigestSize: 64, BlockSize: 128, default)
		317	0x3C2C79AB THash_Sapphire (DigestSize: 64, BlockSize: 1)
		318	0x8A5E8E38 THash_Panama (DigestSize: 32, BlockSize: 32)
		319	0xB663E0D0 THash_Tiger (DigestSize: 24, BlockSize: 64)
		320	0xFF8011A9 THash_RipeMD128 (DigestSize: 16, BlockSize: 64)
		321	0x95375C9F THash_RipeMD160 (DigestSize: 20, BlockSize: 64)
		322	0x553F1430 THash_RipeMD256 (DigestSize: 32, BlockSize: 64)
		323	0xF2DF4DF5 THash_RipeMD320 (DigestSize: 40, BlockSize: 64)
		324	0x08EDC160 THash_Haval128 (DigestSize: 16, BlockSize: 128)
		325	0x625A8C56 THash_Haval160 (DigestSize: 20, BlockSize: 128)
		326	0x0BCCF1B5 THash_Haval192 (DigestSize: 24, BlockSize: 128)
		327	0x031D3312 THash_Haval224 (DigestSize: 28, BlockSize: 128)
		328	0xA252C4F9 THash_Haval256 (DigestSize: 32, BlockSize: 128)
		329	0xE4A5A1FA THash_Whirlpool (DigestSize: 64, BlockSize: 64)
		330	0x1D08108C THash_Whirlpool1 (DigestSize: 64, BlockSize: 64)
		331	0x2105710D THash_Square (DigestSize: 16, BlockSize: 16)
		332	0x5B59FD9D THash_Snefru128 (DigestSize: 16, BlockSize: 48)
		333	0xF1E6F804 THash_Snefru256 (DigestSize: 32, BlockSize: 32)
		334	Byte 1 Size of seed (default: 32 byte = 0x20)
19	daniel-mar	335	Binary 0-255 Seed (Random data)
20	daniel-mar	336	Binary var With DEC 5.1c encrypted data (read until file end minus the size of the checksum and the file terminus)
		337	Encryption-Password = Hash->KDfx(User-Password, Seed); KDFx is proprietary to DEC
19	daniel-mar	338	[I don't understand this paragraph anymore. You can probably ignore it.]
		339	The final version of (De)Coder 4.1 can also use a 2-factor-method.
		340	The "special-checksum" of a file can be used as the user password.
		341	The formula is:
		342	User-Password = Hash(File-Contents)
		343	Combined formula:
		344	Encryption-Password = Hash->KDfx(Hash(File-Contents), Seed)
		345	[End]
		346	Binary var Secured checksum of the data before encryption
15	daniel-mar	347	= Hash(Hash(Original Data) & Seed & Hash(Seed & Hash(Seed & User-Password)))
23	daniel-mar	348	Size dependend on the hash algorithm (DigestSize).
15	daniel-mar	349	The algorithms of DEC give out a hash with the length 16-64.
19	daniel-mar	350	Binary 8 DC4-Terminus; Hardcoded value: 63 F3 DF 89 B7 27 20 EA
14	daniel-mar	351	---------------------------------------------------------------------------------------------------
		352
		353
19	daniel-mar	354	[5.0] DC4 STANDARD 4 USED BY (DE)CODER 5.0
		355	==========================================
		356
22	daniel-mar	357	This file format was intended to be used by (De)Coder 5.0. The file-name extension can be dc4 or dc5.
19	daniel-mar	358
		359	---------------------------------------------------------------------------------------------------
		360	Offset Type Size Content/Description
		361	---------------------------------------------------------------------------------------------------
		362	00h Byte 1 Compress mode flag
		363	Bit 0/LSB: [Ver1+] Is ZIP compressed folder (1) or a regular file (0)?
		364	Bit 1: [Ver2+] Additionally ZLib compressed (1) or not ZLib compressed (0)? (default: 1 for regular files, 0 for ZIP folders)
		365	Bit 2: Reserved
		366	Bit 3: Reserved
		367	Bit 4: Reserved
		368	Bit 5: Reserved
		369	Bit 6: Reserved
		370	Bit 7/MSB: Reserved
		371	01h Byte 1 Version flag; Hardcoded value: 04h
20	daniel-mar	372	02h Binary 27 Magic Sequence; Hardcoded value: "1.3.6.1.4.1.37476.2.2.1.4"
		373	This is the OID { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) 37476 products(2) decoder(2) fileformat(1) dc4(4) }
		374	1Bh Byte 1 Size of the encrypted filename that follows
22	daniel-mar	375	1Ch Binary var Original file name, UTF-8 Encoded; possible values:
25	daniel-mar	376	- Original name in its entirety (example "foobar.txt")
		377	- Just its extension (example "*.txt")
		378	- Redacted (empty string "")
24	daniel-mar	379	Long 4 DEC 6.4 Idendity-Base; Default Idendity-Base: 0x1259D82A.
20	daniel-mar	380	Backwards compatible with DEC 5.1c. Also, the following internal renaming is applied
		381	to ensure that the identity base is equal to DEC 5.1c:
24	daniel-mar	382	- TCipher_AES (DEC 6.4) will be renamed to TCipher_Rijndael (DEC 5.1)
		383	- THash_Whirlpool0 (DEC 6.4) will be renamed to THash_Whirlpool (DEC 5.1)
		384	- THash_SHA0 (DEC 6.4) will be renamed to THash_SHA (DEC 5.1)
		385	Long 4 DEC 6.4 Cipher idendity. If the default identitiy base 0x1259D82A is used, then the identities are:
20	daniel-mar	386	0x14CEB4D7 TCipher_1DES (KeySize: 8, BlockSize: 8, BufferSize: 8)
		387	0x366FED8E TCipher_Mars (KeySize: 56, BlockSize: 16, BufferSize: 16)
		388	0xA2EC8332 TCipher_Skipjack (KeySize: 10, BlockSize: 8, BufferSize: 8)
		389	0xE70AA3F1 TCipher_SAFER (KeySize: 16, BlockSize: 8, BufferSize: 8)
		390	0x9DB9BBFE TCipher_Cast128 (KeySize: 16, BlockSize: 8, BufferSize: 8)
		391	0x03676321 TCipher_RC4 (KeySize: 256, BlockSize: 1, BufferSize: 16)
		392	0xBD7FDE66 TCipher_XTEA (KeySize: 16, BlockSize: 8, BufferSize: 8)
		393	0xE34824EA TCipher_SCOP (KeySize: 48, BlockSize: 4, BufferSize: 32)
		394	0xEA04C614 TCipher_RC2 (KeySize: 128, BlockSize: 8, BufferSize: 8)
		395	0x2E2D64C2 TCipher_NewDES (KeySize: 15, BlockSize: 8, BufferSize: 8)
		396	0xED69020D TCipher_RC6 (KeySize: 256, BlockSize: 16, BufferSize: 16)
		397	0x067B1B39 TCipher_2DES (KeySize: 16, BlockSize: 8, BufferSize: 8)
		398	0xC7CCBE8E TCipher_Q128 (KeySize: 16, BlockSize: 16, BufferSize: 16)
		399	0xC34E0F9D TCipher_Twofish (KeySize: 32, BlockSize: 16, BufferSize: 16)
		400	0x242D1EEF TCipher_Blowfish (KeySize: 56, BlockSize: 8, BufferSize: 8)
		401	0xB83DBC1A TCipher_AES128 (KeySize: 16, BlockSize: 16, BufferSize: 16)
		402	0x3D65C076 TCipher_3DDES (KeySize: 24, BlockSize: 16, BufferSize: 16)
		403	0x6D7C97E9 TCipher_3TDES (KeySize: 24, BlockSize: 24, BufferSize: 24)
		404	0x241E4D6F TCipher_3Way (KeySize: 12, BlockSize: 12, BufferSize: 12)
		405	0x71DF3DA6 TCipher_TEA (KeySize: 16, BlockSize: 8, BufferSize: 8)
		406	0x66BC7BE6 TCipher_Null (KeySize: 0, BlockSize: 1, BufferSize: 8)
		407	0x1282B983 TCipher_AES256 (KeySize: 32, BlockSize: 16, BufferSize: 16)
		408	0xBEC77C5C TCipher_3DES (KeySize: 24, BlockSize: 8, BufferSize: 8)
		409	0x0005E9C6 TCipher_2DDES (KeySize: 16, BlockSize: 16, BufferSize: 16)
		410	0x59907F62 TCipher_Square (KeySize: 16, BlockSize: 16, BufferSize: 16)
		411	0x3706BE67 TCipher_Cast256 (KeySize: 32, BlockSize: 16, BufferSize: 16)
		412	0x323E180B TCipher_Sapphire (KeySize: 1024, BlockSize: 1, BufferSize: 32)
		413	0x49FC4DEC TCipher_IDEA (KeySize: 16, BlockSize: 8, BufferSize: 8)
		414	0x988B2D75 TCipher_AES (KeySize: 32, BlockSize: 16, BufferSize: 16, default)
		415	0xFEA5D6A8 TCipher_Shark (KeySize: 16, BlockSize: 8, BufferSize: 8)
		416	0xD4338402 TCipher_Gost (KeySize: 32, BlockSize: 8, BufferSize: 8)
		417	0x238839FE TCipher_Misty (KeySize: 16, BlockSize: 8, BufferSize: 8)
		418	0x746053B7 TCipher_RC5 (KeySize: 256, BlockSize: 8, BufferSize: 8)
		419	0x1E9E700C TCipher_TEAN (KeySize: 16, BlockSize: 8, BufferSize: 8)
		420	0xBB1C8CCF TCipher_AES192 (KeySize: 24, BlockSize: 16, BufferSize: 16)
24	daniel-mar	421	Byte 1 DEC 6.4 Cipher mode
19	daniel-mar	422	0x00 CTSx double CBC, with CFS8 padding of truncated final block (default, proprietary to DEC)
		423	0x01 CBCx Cipher Block Chainung, with CFB8 padding of truncated final block
		424	0x02 CFB8 8bit Cipher Feedback mode
		425	0x03 CFBx CFB on Blocksize of Cipher
		426	0x04 OFB8 8bit Output Feedback mode
		427	0x05 OFBx OFB on Blocksize bytes
		428	0x06 CFS8 8Bit CFS, double CFB
		429	0x07 CFSx CFS on Blocksize bytes
		430	0x08 ECBx Electronic Code Book
		431	0x09 GCM Galois Counter Mode
24	daniel-mar	432	0x0A CTS3 double CBC, with less secure padding of truncated final block (deprecated)
		433	Long 4 DEC 6.4 Hash idendity. If the default identitiy base 0x1259D82A is used, then the identities are:
20	daniel-mar	434	0x42F48DAB THash_Panama (DigestSize: 32, BlockSize: 32)
		435	0x9D9517A3 THash_RipeMD256 (DigestSize: 32, BlockSize: 64)
		436	0xC366F226 THash_Haval192 (DigestSize: 24, BlockSize: 128)
		437	0xB441391C THash_SHA384 (DigestSize: 48, BlockSize: 128)
		438	0xEE234C4A THash_SHA256 (DigestSize: 32, BlockSize: 64)
		439	0xC047C2F3 THash_Haval128 (DigestSize: 16, BlockSize: 128)
		440	0xA09321D2 THash_SHA3_224 (DigestSize: 28, BlockSize: 144)
		441	0xE9AF729E THash_Square (DigestSize: 16, BlockSize: 16)
		442	0x2F5EA7BA THash_Keccak_224 (DigestSize: 28, BlockSize: 144)
		443	0x6792C1A1 THash_SHA3_512 (DigestSize: 64, BlockSize: 72, default)
		444	0x93F3FE0E THash_Snefru128 (DigestSize: 16, BlockSize: 48)
		445	0xE85F47C9 THash_Keccak_512 (DigestSize: 64, BlockSize: 72)
		446	0xF4867A38 THash_Sapphire (DigestSize: 64, BlockSize: 1)
		447	0x5BBEA36F THash_SHA3_384 (DigestSize: 48, BlockSize: 104)
		448	0x7CE2D79E THash_SHA0 (DigestSize: 20, BlockSize: 64)
		449	0x8E115051 THash_Keccak_256 (DigestSize: 32, BlockSize: 136)
		450	0xD4732507 THash_Keccak_384 (DigestSize: 48, BlockSize: 104)
		451	0xAAF08FC5 THash_Haval160 (DigestSize: 20, BlockSize: 128)
		452	0x4F6CBBA1 THash_SHA224 (DigestSize: 28, BlockSize: 64)
		453	0xEC61EF43 THash_BCrypt (DigestSize: 23, BlockSize: 8)
		454	0xA2A52389 THash_Whirlpool0 (DigestSize: 64, BlockSize: 64)
		455	0x0BE5E708 THash_SHA1 (DigestSize: 20, BlockSize: 64)
		456	0x6AF8C76A THash_Haval256 (DigestSize: 32, BlockSize: 128)
		457	0x394CFB97 THash_Snefru256 (DigestSize: 32, BlockSize: 32)
		458	0xA3649174 THash_MD2 (DigestSize: 16, BlockSize: 16)
		459	0x4A073441 THash_MD4 (DigestSize: 16, BlockSize: 64)
		460	0x01DCD639 THash_SHA3_256 (DigestSize: 32, BlockSize: 136)
		461	0x5D9D5F0C THash_RipeMD160 (DigestSize: 20, BlockSize: 64)
		462	0x3D0004D7 THash_MD5 (DigestSize: 16, BlockSize: 64)
		463	0xE87A86C8 THash_WhirlpoolT (DigestSize: 64, BlockSize: 64)
		464	0xCBB73081 THash_Haval224 (DigestSize: 28, BlockSize: 128)
		465	0x7EC9E343 THash_Tiger (DigestSize: 24, BlockSize: 64)
		466	0x3A754E66 THash_RipeMD320 (DigestSize: 40, BlockSize: 64)
		467	0xF7DACACC THash_Shake256 (DigestSize: 0, BlockSize: 136)
		468	0x886D5BD2 THash_SHA512 (DigestSize: 64, BlockSize: 128)
		469	0x5D65CF55 THash_Shake128 (DigestSize: 0, BlockSize: 168)
		470	0xD5A2131F THash_Whirlpool1 (DigestSize: 64, BlockSize: 64)
		471	0x372A123A THash_RipeMD128 (DigestSize: 16, BlockSize: 64)
24	daniel-mar	472	Byte 1 IV Size (default: 16 = 0x10)
		473	Binary var IV (Random Data)
26	daniel-mar	474	Byte 1 Blocking filling mode (default: 0x00)
		475	0x00 Byte filling mode
24	daniel-mar	476	Byte 1 Filler byte of last block (default: 0xFF)
		477	Byte 1 Size of seed (default 32 = 0x20)
		478	Binary 0-255 Seed (Random data)
19	daniel-mar	479	Byte 1 KDF version
		480	0x01 KDF1
		481	0x02 KDF2
		482	0x03 KDF3
26	daniel-mar	483	0x04 KDFx (default, proprietary to DEC)
		484	0x05 PBKDF2
		485	Long 4 PBKDF iterations (ONLY present if KDF Version = 0x05)
24	daniel-mar	486	Binary var With DEC 6.4 encrypted data (read until file end minus the size of the checksum)
20	daniel-mar	487	Encryption-Password = Hash->KDf<Version>(User-Password, Seed)
19	daniel-mar	488	Binary var HMAC checksum (Encrypt-then-HMAC)
20	daniel-mar	489	= HMAC(HMacKey, EncryptedData)
23	daniel-mar	490	with Key = Encryption-Password
		491	Size dependend on the hash algorithm (DigestSize).
19	daniel-mar	492	The algorithms of DEC give out a hash with the length 16-64.
		493	---------------------------------------------------------------------------------------------------
		494
		495
20	daniel-mar	496	== [APPENDIX A] COMMENTS ==
14	daniel-mar	497
		498	* Links to websites
		499
20	daniel-mar	500	Source code and program "(De)Coder" downloadable at:
		501	https://www.viathinksoft.com/projects/decoder
14	daniel-mar	502
20	daniel-mar	503	Other information about the file extension:
		504	https://fileinfo.com/extension/dc4
14	daniel-mar	505
20	daniel-mar	506	Delphi Encryption Compendium (DEC) downloadable at:
		507	https://github.com/MHumm/DelphiEncryptionCompendium

Subversion Repositories decoder

decoder/trunk/Private/dc4-spec.txt – Rev 27