55
$\begingroup$

Like in title: which one of these encryption methods (ZipCrypto, AES-256) is more secure and why? I am asking about it because I'd like to know which should be preferred when compressing files with Zip.

$\endgroup$
45
$\begingroup$

According to 7-Zip,

Use ZipCrypto, if you want to get archive compatible with most of the ZIP archivers. AES-256 provides stronger encryption, but now AES-256 is supported only by 7-Zip, WinZip and some other ZIP archivers.

So really there is some balance to be played with. Do you require better security at the sacrifice of compatibility or more compatibility at the sacrifice of security?

According to the Info-Zip FAQ, it sounds like ZipCrypto is pretty weak. Keep that in mind when making your decision.

Note: The link on Info-Zip FAQ to the publication is broken, you can find the file on A Known-Plaintext Attack on the PKZIP Stream Cipher

$\endgroup$
  • 12
    $\begingroup$ Indeed, ZipCrypto is weak. It is subject to known-plaintext attack, see ZIP Attacks with Reduced Known Plaintext. Also ZipCrypto comes without serious attempt at slowing exhaustive password search, when there at least exist the possibility that an AES-256 implementation has that. $\endgroup$ – fgrieu Sep 13 '12 at 16:26
  • 5
    $\begingroup$ in computer terms, weak means, never ever use it. go for aes $\endgroup$ – Uğur Gümüşhan Apr 25 '15 at 15:37
  • 3
    $\begingroup$ Only for your information: I tested the "AES-256" option and it is not supported by Windows 10. $\endgroup$ – mgutt Nov 23 '16 at 8:27
  • 2
    $\begingroup$ Now you know how much Windows 10 is interested in securing your personal data $\endgroup$ – aliopi Jul 13 '17 at 11:49
-1
$\begingroup$

The main advantage of using the Zip archive file format is that it is a standard format that (for all newer versions of Windows at least, which I think goes back to Windows 2000) is directly supported by the Windows OS. That is, you don't need to download any additional software to compress or decompress Zip files. Windows doesn't support encrypting Zip files though, but third party software like 7Zip do. However, Windows does support DECRYPTING Zip files, at least those encrypted with ZipCrypto. 7Zip supports encrypting with one of 2 types of encryption. These are ZipCrypto and AES-256. AES is by far the stronger of the 2 types, but it has one major flaw. That flaw is it CANNOT be decrypted with Windows, only with 3rd party software (like 7Zip itself) that supports AES decryption.

If you want to send a file to somebody that is encrypted, and make sure it can be decrypted without asking them to download additional software, your best bet is to use 7Zip set to perform ZipCrypto encryption. Why not just use AES encrypted Zip and then tell the recipient to download 7Zip so they can decrypt it? The answer to that is simple. There's no point in that. There's no point in sending an AES encrypted Zip file at all in fact. AES is already supported in the much better compressed file type called 7Z, which of course is 7Zip's default file. 7Z has a better compression ratio than Zip. So if you are going to use AES to encrypt it and make sure that both the sender and the receiver have 7Zip installed on their PCs, you might as well not even bother with the Zip file format, and instead use the 7Z file format. The 7Z file format also has a major advantage when it comes to encryption, because it can encrypt file names as well as the actual bytes of the file itself. If you really don't want somebody to know what you are sending, and file names can give a clue, you would want to be able to encrypt the file name itself.

As for why Zip with AES encryption isn't supported in Windows, it's because it isn't part of the official Zip standard. It was added in 7Zip as an unofficial extension to the Zip standard. Windows's Zip utilities are based strictly on the official Zip format specification.

So here's my recommendations: Use a Zip file with ZipCrypto if you want to send a file that doesn't require external software to decrypt. Use a 7Z file with AES if you want the strongest encryption. Don't use a Zip file with AES encryption, as there's no point in doing so.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.