Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I use the AES256 option in Winzip to encrypt a file, is it any less safe or less secure than using pgp encryption?

share|improve this question
Secure for what, against what? – Thomas May 9 '13 at 3:20
up vote 3 down vote accepted

Winzip allows enumeration of the file names contained within. Try WinRAR or 7zip instead. Winzip AES256 also uses CTR mode.

Both PGP and AES256-CTR are both currently considered "strong."

Can you provide more details about what exactly you're looking to do, or in what context you are evaluating safety and security?

share|improve this answer
In addition to the file names, encrypted ZIP archives also leak the sizes and last modification timestamps of the unencrypted files and, if the older AE-1 format is used, their CRC checksums. Also, since they're vulnerable to various attacks if the attacker can modify the archive. These slides summarize some of the possible vulnerabilities. – Ilmari Karonen May 9 '13 at 14:13
Currently we exchange files with an external vendor and these files contain sensitive information. Most of the time this type of file transfer would be pgp encrypted and transmitted using the vendor's SFTP site. In this particular case we will only be providing this file for limited time and to a specific user, the person on the receiving end has WinZip so I thought we could just use WinZip to encrypt it, but I'm unsure how secure this is. – Tim Kennedy May 9 '13 at 17:27
WinZIP has its faults, but being available and convenient are also likely of consideration. Regardless, it's far more important to your security that you're following good key management practices: use a lengthy high entropy passphrase, securely communicated on a separate channel (preferably two or more separate channels, such as half the passphrase spoken over a land-line and half via iMessage.) – John Deters May 9 '13 at 22:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.