7

Let's suppose that I share an illegal copy of a material on web which is in password protected zip file, can the owner send me a copyright notice or know what's inside the zip without knowing the password?

  • 2
    Possible duplicate of Are password-protected ZIP files secure? – Alexei May 31 '18 at 18:06
  • They can definitely try to crack it and succeed, but the question then might become about law: is it legal to crack o try to crack a password protected file to check if it contains something that breaks copyright? You might want to ask on law.stackexchange, if you don't I might do it myself because it seems interesting. – reed May 31 '18 at 18:27
  • 1
    There was a criminal case involving an encrypted archive from F-Secure where all that was needed for a conviction was file names and sizes, no file contents. – forest Jun 1 '18 at 0:15
  • 1
    Yes, and trivially. An attack from '94 has allowed decrypting ZipCrypto-encrypted files in minutes without knowledge of the password. – forest Jun 1 '18 at 14:46
4

Potentially, yes.

Encrypted zip files protect the data reasonably well (perhaps the equivalent of a cheap lock) but leak meta-data about the files inside the zip. Like a cheap lock, an attacker with a small degree of training could still break the underlying encryption. The far easier scenario is the meta-data, which requires no cracking. That means the filenames, file dates, file lengths, and directory names of all the files inside the zip file are all stored in the clear. This is extremely trivial to find without the password, and can be done using the command line zip utility to list the contents of the zip file.

If the file names inside the zip file have names associated with copyrighted content, the copyright holder is going to assume the zip file contains copy-written content. Matching file sizes of the original files would only provide further evidence.

One way to protect against this is to simply zip up your files, and then zip-encrypt the resulting zip file again. The meta-data at the lower level should now be protected by the outer layer zip file. You'd still be vulnerable to the attacks above to decrypt the data since the encryption is still "cheap lock" equivalent.

  • why do you need to encrypt the inner zip? – dandavis May 31 '18 at 19:47
  • 2
    @dandavis Now that I think about it, I think you're right. There's no need to encrypt the inner zip. I'll change the answer. – Steve Sether May 31 '18 at 19:54
  • 1
    Zip encryption (when using the default ZipCrypto rather than one of the two strong ad hoc implementations using AES) is not reasonably good. In fact, it's really, really bad. – forest Jun 1 '18 at 0:14
  • 1
    Let us continue this discussion in chat. – Steve Sether Jun 1 '18 at 14:24
  • 2
    DON'T DO THE "ONE WAY..." OPTION - zips are bad for security, just don't. – Jonathan Jun 1 '18 at 18:24
7

Yes. Aside from the fact that the filenames are unencrypted, the contents of a password-protected Zip file can be recovered if it uses the old, insecure ZipCrypto cipher which uses the insecure, non-cryptographic CRC algorithm for data confidentiality. A research paper from 1994 showed that an attack against the underlying encryption can be done in several hours regardless of the strength of the password on a contemporary home PC. Nowadays, such an attack can be completed in seconds with free and publicly available tools. You must not rely on default, legacy Zip encryption.

The PKZip format supports three encryption methods. The first is the legacy, highly-insecure ZipCrypto. The second is AES-based encryption stored in the compression field in the metadata, and the third is AES-based encrypting using its own header format. The encryption specification is online. Using AES-based encryption rather than legacy encryption can result in incompatibilities, especially with older programs, but most modern, well-designed Zip programs can handle it.

In order to protect the contents of a Zip file, you should use strong encryption. Various tools such as WinZip and 7zip support an ad hoc AES-based format for Zip files which additionally encrypts the individual filenames and sizes within the compressed archive.

3

Yes. Yes. They can.

https://unix.stackexchange.com/questions/289999/how-to-zip-directory-with-encryption-for-file-names

The main point is in zip encryption, the filenames are not encrypted. WHAT A JOKE.

That means if you name your file "taylor swift's latest song", they could reasonably infer that your zip archive contains tailor swift's song, and file a takedown notice.

I haven't tried this, but maybe you can double zip. 1. zip the files into a file called "files.zip", and 2. zip and encrypt the file "files.zip". Then when you look into the encrypted archive's files, all you see is "files.zip" and that reveals no information about the actual data.

Do not use zip for security. --- INSTEAD try send.firefox.com

  • The compression algorithm is fixed, zip within zip file size will leak original file name size. You should add some "salt" file to the inner zip. – mootmoot Jun 1 '18 at 15:39
  • @mootmoot the size of the filename isn't part of the new zip file. But regardless, it doesn't matter. Don't use zip for security. – Jonathan Jun 1 '18 at 18:20
  • Not sure I'd recommend trusting a web service for encrypting files when it's really not necessary – AndrolGenhald Jun 1 '18 at 23:41
  • It’s better than the alternative discussed here. – Jonathan Jun 2 '18 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.