1

This question already has an answer here:

A year ago I started a memoir and wrote 120000 words, which I password protected in LibreOffice 3 writer. I took a break of many months, and intended to resume writing the document a couple of days ago.

However..

I have forgotten my password. This is a complete disaster. I made my wife aware of the password (just in case !) But she has also forgotten it.

Here is my rather obvious question - Is there some way of accessing the memoir with out the password?

I'm very non technical, and following a search I discovered a possible means of using xmlcopyeditor to turn off the password and thereby access the document. But this doesn't work - the xmlcopyeditor doesn't seem to open.

There are three copies of the memoir, one on a flashdrive thing, one on a cd rom, and one in the laptop, all are protected by the same password.

Very frustrated indeed.

marked as duplicate by Glutanimate, Nathan Osman, Fabby, Eric Carvalho, Evandro Silva Jan 14 '15 at 16:53

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1

Really sorry for you, Libreoffice is using AES encryption when using password protection, and AES has no known flaws. The only way is to provide the correct password, without that you cannot bypass it. If you have had a password shorter than 7 chars, you can try to brute force it. If the password is larger than 6 characters, it will can take years to break it.

  • 1
    You can still do a dictionary attack. Although it helps if you sort of remember what the password looked like. – Minos Jan 13 '15 at 12:43
1

This is a copy-paste from another answer ( link here ). All credits to the original author of the question.

You will have to use a brute-force software to open it. These programs often use brute-force or dictionary-based attacks. I would not use such a closed-source programs from random, untrusted sources as suggested. Virus scanners do not find everything, so you still cannot trust the executable because ClamAV detects nothing.

Since LibreOffice is open source, I'd start with looking up what kind of encryption it uses. Ubuntu 12.04 ships with LibreOffice 3.5. According to http://wiki.documentfoundation.org/ReleaseNotes/3.5#Different_Encryption_Algorithm, it uses a 256-bits AES cipher.

This mailing list post also makes clear that the password is derived using PBKDF2 which means that brute-forcing will be much slower with a sufficient high iteration count.

Since .ods files are just Zip files, I tried to encrypt the file and extracted the contents. As expected, the contents of the document are encrypted and indistinguishable from random bytes. Of course there exist some unencrypted metadata, one of them being META-INF/manifest.xml. My example encrypted spreadsheet contained the following interested parts:

<manifest:encryption-data manifest:checksum-type="urn:oasis:names:tc:opendocument:xmlns:manifest:1.0#sha256-1k" manifest:checksum="48KzqP1PL7Wu/YTtHzlN0buJeUmigGT247dZ6Wrj10s=">
<manifest:algorithm manifest:algorithm-name="http://www.w3.org/2001/04/xmlenc#aes256-cbc" manifest:initialisation-vector="82mrg52Yifh1iIye5W0xuw=="/>
<manifest:key-derivation manifest:key-derivation-name="PBKDF2" manifest:key-size="32" manifest:iteration-count="1024" manifest:salt="hUZrwD1BWkODYVklZiScqA=="/>
<manifest:start-key-generation manifest:start-key-generation-name="http://www.w3.org/2000/09/xmldsig#sha256" manifest:key-size="32"/>

From that we can learn that LibreOffice uses a SHA256 hashing algorithm for checking data integrity, AES256 in CBC mode. The 32-byte password is derived from your password using PBKDF2 with 1024 iterations.

A paper on decrypting ODF files is available here, these contain nice information to craft your own brute-forcer but are probably not suitable for the average user.

As with most encryption products, password recovery is near impossible. I suggest:

  • If the file just contains bookkeeping for a week, just start over and do not waste time on decrypting the file.
  • Try to recall the password if you want to decrypt the file.
  • If you are going to use a brute-force program, do not use a random program found on the internet. Try to find an open-source program. If you only find closed-source programs, download it from a reliable source and ensure that it has good reviews (from several sources), put it through https://www.virustotal.com and check again that the program you are trying is legit.

Not the answer you're looking for? Browse other questions tagged or ask your own question.