31

It obviously doesn't connect with any sort of database. How is this even possible?

Improve this question
1
  • 4
    Because whatever you'd store in that database is stored locally in the zip file itself.
    – Dmitry Grigoryev
    Commented Apr 23, 2020 at 7:17

2 Answers 2

Reset to default
70

Thinking of it as "password protection" slightly misrepresents the actual situation.

What happens when you password-protect a zip file is that the archive is encrypted using a symmetric algorithm (same key to encrypt and decrypt) using the password as the key.

The unzipper program "checks" whether the key is correct the same way I check whether the key to my front door is correct: If it opens the lock, it was the correct key.

So in this case the unzipper attempts to decrypt the data using the password you provide, and if the output is a properly structured archive, it was the correct password.

(I'm skipping the whole cryptography debate WRT collisions and possible duplicate keys for now; this is about how the concept works in theory rather than a specific implementation that may or may not have flaws)

EDIT: As user MobyDisk points out in comments, in the case of Zip specifically, the structure and the file tree are not encrypted, just the files themselves, as well as checksums for each file. If the password you use decrypts the file, and the decrypted checksum matches, you had the right password.

Improve this answer
13
  • 30
    Unfortunately your house door key analogy doesn't work. Any decryption key will work in that you'll get an output, but only the correct one will produce your house when you open the door. All the incorrect keys will open the door but it won't be your house on the other side.
    – Eborbob
    Commented Apr 21, 2020 at 12:27
  • 78
    @eborbob Semantics. It's a metaphor, it doesn't have to map 1:1 to reality.
    – Shadur-don't-feed-the-AI
    Commented Apr 21, 2020 at 12:28
  • 32
    @Eborbob Any key will go into the lock and move the pins - only if the pattern is valid will the lock let you turn it. Any decryption key will go into the zip tool - only if the pattern is valid will the tool let you open it. Seems fine to me.
    – Chronocidal
    Commented Apr 21, 2020 at 14:57
  • 23
    I am now intrigued by the idea of a doorway that can take you to different places depending on what key you use to unlock it.
    – Seth R
    Commented Apr 21, 2020 at 16:19
  • 12
    @SethR - That's an elevator in a building with full-floor apartment units.
    – bta
    Commented Apr 22, 2020 at 22:21
35

It depends on the specific zip crypto algorithm.

For example, the original ZIP specification used the password to initialize a set of three 32-bit decryption keys. Then the ZIP header (12 random bytes placed at the beginning) was decrypted and then:

"After the header is decrypted, the last 1 or 2 bytes in Buffer SHOULD be the high-order word/byte of the CRC for the file being decrypted...This can be used to test if the password supplied is correct or not."

(ZIP Spec, section 6.1)

Improve this answer
3
  • 3
    To summarize into the answer Andy is likely looking for: a "password protected" zip file is encrypted using the password as the key. If using the password with the decryption algorithm results in a proper zip file structure, the password was correct.
    – Shadur-don't-feed-the-AI
    Commented Apr 21, 2020 at 12:02
  • @Shadur In the original ZIP file specification, the zip file structure itself is not encrypted. You can see the list of files even without the password. It looks like only the file and it's CRC are encrypted.
    – Moby Disk
    Commented Apr 21, 2020 at 13:44
  • @MobyDisk I see. Thanks for the clarification.
    – Shadur-don't-feed-the-AI
    Commented Apr 21, 2020 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .