Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

You have a zip file that you created with 7z to password-protect it with AES 128. Can a smart adversary extract the data only through brute force, or is the file vulnerable to other attacks - such as, I don't know, being able to bypass the password and extract the data?

share|improve this question

3 Answers 3

up vote 8 down vote accepted

ZIP files are encrypted with AES-256, and the key is derived using a slow key-derivation function (KDF), which makes bruteforce and dictionary attacks generally infeasible. There are no currently known ways to bypass the encryption.

share|improve this answer
    
ZIP files can be encrypted with AES less stronger than AES-256! 7-Zip offers only AES-256 (or old CryptoZip), but Total Commander for example can encrypt ZIPs with AES-192 and AES-128 as well. So your correction to OP is wrong. –  trejder May 13 '13 at 8:08
    
@trejder Except that the current best known attack against AES-128 will still finish about the same time as the heat death of the universe, even if we factor Moore's law in. And that's assuming zero cost for the KDF, which will actually be the largest computational factor. –  Polynomial Nov 7 '13 at 22:47
    
I totally agree with you, of course. I just wanted to point out, that (what I get as) correction, that ZIPs are encrypted with AES-256 is (may be) a little bit misleading. Nothing else, no offence. –  trejder Nov 8 '13 at 6:55

In direct meaning, you mentioned (extracting data), no. But keep in mind, however, that any program (or user) can (without knowing the password):

  • browse list of files inside password-protected ZIP archive,
  • check file types (try to send encrypted, password-protected ZIP containing EXE file via Gmail).

ZIP files can also be "broken" in the meaning, that you can overwrite exisiting, password-protected file, stored inside ZIP file, with another file, named the same, without knowing the password.

All these mentioned operations does not give attacker access to contents (he or she is still unable to extract data), only list it or destroy it. So I'm mentioning this only as a possible side effects, you may be not aware of. Some people treats this as security leaks, stating that for this reasons, ZIP files are insecure, but other my assume that security is not violated, even with these mentioned "additions".

Since contents of ZIP file can be changed, without knowing the password, by replacing a password-protected file with another one, we can speak about complete insecurity in psychological terms (social engineering, hacking etc.). Attacer can alter contents of ZIP file, without knowing the password and claim to its victim that it is unchanged. Victim, without knowing above mentioned side-effects, may incorrectly assume, that archive hasn't been changed or its contents aren't altered, since he or she (the victim) is the only person, that knows the password.

Here you have my simple question about security of ZIP files, which turned out to be a very good readout, with a lot of useful answers and comments.

share|improve this answer

No, as far as I'm aware, there are no current viable attack vectors other than brute forcing the password.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.