If I use the AES-256 option in WinZip to encrypt a file, is it any less safe or less secure than using PGP encryption?

  • $\begingroup$ Secure for what, against what? $\endgroup$ – Thomas May 9 '13 at 3:20

WinZip allows enumeration of the file names contained within. Try WinRAR or 7zip instead. WinZip AES-256 also uses CTR mode.

Both PGP and AES-256 in CTR mode are both currently considered "strong."

Can you provide more details about what exactly you're looking to do, or in what context you are evaluating safety and security?

| improve this answer | |
  • $\begingroup$ In addition to the file names, encrypted ZIP archives also leak the sizes and last modification timestamps of the unencrypted files and, if the older AE-1 format is used, their CRC checksums. Also, since they're vulnerable to various attacks if the attacker can modify the archive. These slides summarize some of the possible vulnerabilities. $\endgroup$ – Ilmari Karonen May 9 '13 at 14:13
  • $\begingroup$ Currently we exchange files with an external vendor and these files contain sensitive information. Most of the time this type of file transfer would be pgp encrypted and transmitted using the vendor's SFTP site. In this particular case we will only be providing this file for limited time and to a specific user, the person on the receiving end has WinZip so I thought we could just use WinZip to encrypt it, but I'm unsure how secure this is. $\endgroup$ – Tim Kennedy May 9 '13 at 17:27
  • 1
    $\begingroup$ WinZIP has its faults, but being available and convenient are also likely of consideration. Regardless, it's far more important to your security that you're following good key management practices: use a lengthy high entropy passphrase, securely communicated on a separate channel (preferably two or more separate channels, such as half the passphrase spoken over a land-line and half via iMessage.) $\endgroup$ – John Deters May 9 '13 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.