5
$\begingroup$

If I use the AES-256 option in WinZip to encrypt a file, is it any less safe or less secure than using PGP encryption?

$\endgroup$
1
  • $\begingroup$ Secure for what, against what? $\endgroup$
    – Thomas
    Commented May 9, 2013 at 3:20

1 Answer 1

4
$\begingroup$

WinZip allows enumeration of the file names contained within. Try WinRAR or 7zip instead. WinZip AES-256 also uses CTR mode.

Both PGP and AES-256 in CTR mode are both currently considered "strong."

Can you provide more details about what exactly you're looking to do, or in what context you are evaluating safety and security?

$\endgroup$
3
  • $\begingroup$ In addition to the file names, encrypted ZIP archives also leak the sizes and last modification timestamps of the unencrypted files and, if the older AE-1 format is used, their CRC checksums. Also, since they're vulnerable to various attacks if the attacker can modify the archive. These slides summarize some of the possible vulnerabilities. $\endgroup$ Commented May 9, 2013 at 14:13
  • $\begingroup$ Currently we exchange files with an external vendor and these files contain sensitive information. Most of the time this type of file transfer would be pgp encrypted and transmitted using the vendor's SFTP site. In this particular case we will only be providing this file for limited time and to a specific user, the person on the receiving end has WinZip so I thought we could just use WinZip to encrypt it, but I'm unsure how secure this is. $\endgroup$ Commented May 9, 2013 at 17:27
  • 1
    $\begingroup$ WinZIP has its faults, but being available and convenient are also likely of consideration. Regardless, it's far more important to your security that you're following good key management practices: use a lengthy high entropy passphrase, securely communicated on a separate channel (preferably two or more separate channels, such as half the passphrase spoken over a land-line and half via iMessage.) $\endgroup$ Commented May 9, 2013 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.