Caolan,

> I have had one suggestion that the pagenumber of the block that is being
> decrypted is somehow inputted into the key setup routine. But i have not
> had any actual code or enough details to actually implement this, Do you
> have an idea ?. I would be very interested in hearing about it, even if
> you are not absolutel sure.

I have done some tests with a larger word document now and it seems to work.

I did the same thing you got suggested and put the block number into byte
6 to 9 of the input data for the second MD5 hash. Now this second MD5
hash makes more sense and its even obvious now why the pad byte 0x80 is
in byte 10.

I have done some minor modifactions to the test code, I just put the
generation of the RC4 key in a separate subroutine makekey() which gets
called for every 512 byte block of data.

The code is included in the appended ZIP archive. I did not use your
code for accessing word documents, I just opened the files with the
data streams directly. This is cause I tested it under Windows NT and
did not have enough time to compile the word viewer sources. It should
work with the viewer sources if you define "TEST" to 0.

I hope the code works.

Best regards,
  Dieter Spaar