11

I am interested in knowing if either of them is easier to crack than the other because of inherent flaws.

2 Answers 2

13

It depends on how the ZIP file is encrypted.

When you want to create a fully standard-compliant ZIP archive, then your only option for encryption is the ZipCrypto algorithm which is known to be seriously flawed.

However, many compression tools support a non-standard addition to the ZIP standard which allows to use different encryption algorithms, including AES-256, which is the same encryption algorithm the 7z format uses by default. When that option is used, 7z and zip are equally hard to crack.

Caveat: not every archive handler can handle AES-256 encrypted ZIP archives. Such tools can then no longer read the files in such archives. One such archive handler is the one built into Windows Explorer.

3
  • upvoting for mentioning the Zip AES extension; I myself did not remember that.
    – LSerni
    Commented Oct 24, 2015 at 17:13
  • 3
    A more complete answer would compare the different key stretching algorithms used by the different formats. Commented Oct 24, 2015 at 19:19
  • Philipp, thanks for mentioning that some Zip archivers use the ZipCrypto algo! Commented Oct 26, 2015 at 13:46
3

if either of them is easier to crack than the other because of inherent flaws

Briefly: yes. You'd be better served by 7Zip, which uses

encryption with AES-256 algorithm. This algorithm uses cipher key with length of 256 bits. To create that key 7-Zip uses derivation function based on SHA-256 hash algorithm. A key derivation function produces a derived key from text password defined by user.

Also,

For increasing the cost of exhaustive search for passwords 7-Zip uses big number of iterations to produce cipher key from text password.

On the down side, 7Zip is not natively supported by as many platforms as standard Zip, so if you need to distribute files, you'll have to warn users and include links to downloadable software for their platforms.

2
  • Isemi, you're right about lack of default availability of 7z. Unrelated to this I have installed 7z on my Ubuntu 14.10 machine via software center. I can access the command line tools. However, while using nautilus(GUI), it seems that the only option I have is the Archive manager. Did I miss to install something? Commented Oct 26, 2015 at 13:48
  • 1
    @AlexanderSuraphel: No, you did not miss installing anything; the original developer of 7zip does not write 7-Zip GUI for Linux, the 7-Zip GUI only supports Windows. In Ubuntu, to create archives from a GUI, you would use Nautilus or File Roller/Archive Manager which supports 7zip file format if the p7zip package is installed.
    – Lie Ryan
    Commented Mar 27, 2016 at 16:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .