Like in title: which one of these encryption methods (ZipCrypto, AES-256) is more secure and why? I am asking about it because I'd like to know which should be preferred when compressing files with Zip.
$\begingroup$
$\endgroup$
Add a comment
|
3 Answers
$\begingroup$
$\endgroup$
4
According to 7-Zip,
Use ZipCrypto, if you want to get archive compatible with most of the ZIP archivers. AES-256 provides stronger encryption, but now AES-256 is supported only by 7-Zip, WinZip and some other ZIP archivers.
So really there is some balance to be played with. Do you require better security at the sacrifice of compatibility or more compatibility at the sacrifice of security?
According to the Info-Zip FAQ, it sounds like ZipCrypto is pretty weak. Keep that in mind when making your decision.
Note: The link on Info-Zip FAQ to the publication is broken, you can find the file on A Known-Plaintext Attack on the PKZIP Stream Cipher
-
14$\begingroup$ Indeed, ZipCrypto is weak. It is subject to known-plaintext attack, see ZIP Attacks with Reduced Known Plaintext. Also ZipCrypto comes without serious attempt at slowing exhaustive password search, when there at least exist the possibility that an AES-256 implementation has that. $\endgroup$– fgrieu ♦Sep 13, 2012 at 16:26
-
8$\begingroup$ in computer terms, weak means, never ever use it. go for aes $\endgroup$ Apr 25, 2015 at 15:37
-
4$\begingroup$ Only for your information: I tested the "AES-256" option and it is not supported by Windows 10. $\endgroup$– mguttNov 23, 2016 at 8:27
-
5$\begingroup$ Now you know how much Windows 10 is interested in securing your personal data $\endgroup$– aliopiJul 13, 2017 at 11:49
$\begingroup$
$\endgroup$
3
The main advantage of using the Zip archive file format is that it is a standard format that (for all newer versions of Windows at least, which I think goes back to Windows 2000) is directly supported by the Windows OS. That is, you don't need to download any additional software to compress or decompress Zip files. Windows doesn't support encrypting Zip files though, but third party software like 7Zip do. However, Windows does support DECRYPTING Zip files, at least those encrypted with ZipCrypto. 7Zip supports encrypting with one of 2 types of encryption. These are ZipCrypto and AES-256. AES is by far the stronger of the 2 types, but it has one major flaw. That flaw is it CANNOT be decrypted with Windows, only with 3rd party software (like 7Zip itself) that supports AES decryption.
If you want to send a file to somebody that is encrypted, and make sure it can be decrypted without asking them to download additional software, your best bet is to use 7Zip set to perform ZipCrypto encryption. Why not just use AES encrypted Zip and then tell the recipient to download 7Zip so they can decrypt it? The answer to that is simple. There's no point in that. There's no point in sending an AES encrypted Zip file at all in fact. AES is already supported in the much better compressed file type called 7Z, which of course is 7Zip's default file. 7Z has a better compression ratio than Zip. So if you are going to use AES to encrypt it and make sure that both the sender and the receiver have 7Zip installed on their PCs, you might as well not even bother with the Zip file format, and instead use the 7Z file format. The 7Z file format also has a major advantage when it comes to encryption, because it can encrypt file names as well as the actual bytes of the file itself. If you really don't want somebody to know what you are sending, and file names can give a clue, you would want to be able to encrypt the file name itself.
As for why Zip with AES encryption isn't supported in Windows, it's because it isn't part of the official Zip standard. It was added in 7Zip as an unofficial extension to the Zip standard. Windows's Zip utilities are based strictly on the official Zip format specification.
So here's my recommendations: Use a Zip file with ZipCrypto if you want to send a file that doesn't require external software to decrypt. Use a 7Z file with AES if you want the strongest encryption. Don't use a Zip file with AES encryption, as there's no point in doing so.
-
10$\begingroup$ -1 for recommending ZipCrypto. It is not just weak, but fatally broken. $\endgroup$– forest ♦Jan 6, 2019 at 23:20
-
$\begingroup$ MS's reasons for not supporting AES is also incorrect: devblogs.microsoft.com/oldnewthing/20180515-00/?p=98755 The licensed the code and changing it was not practical. It is documented in PKWare's zip spec since 2003. $\endgroup$ Oct 15, 2019 at 9:07
-
$\begingroup$ The whole licensing excuse is funny when the same article mentions support in .NET. At this point I think Windows has not two, but three separate code bases that can decompress zip: the compressed folder, the .NET class, and bsdtar (tar.exe). Maybe there's more. $\endgroup$ May 17 at 4:39
$\begingroup$
$\endgroup$
1
I just encrypted a zip file on my Mac using WinZip Pro Version 10.5.6553. 256-bit AES was selected as the Encryption method in settings. I transferred the file to the iPhone. In files I opened it, it asked for the password and decrypted it with no problem. Assuming the WinZip Pro App was working correctly, then the standard files app on the iPhone can decrypt zip files encrypted with 256-bit AES encryption. (iOS 16.6.1, just prior to the 17 release)
New contributor
Mark Banjak is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
-
1$\begingroup$ That's a good pro tip. However, it doesn't answer the question itself, and is better suited for Superuser.com since it's more of usage of existing tools. $\endgroup$– DannyNiuyesterday