Zip file with two password

Question

I used this command to password protect a zip file on Linux :

zip -P 9000 hash.zip hash.py

and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 to 100000, the problem is that program find two password on it, first is: 9000 and the second is: 79095 , and both password unzip the file, is the any security vulnerability in Linux zip command?

Answer 1

Both passwords may decrypt the file, but only one password will yield the correct plaintext. The zip encryption format is just checking to see if the padding is correct to verify that the correct key was used. The password 79095 produced valid padding, however the resulting message is garbage.

Answer 2

See http://en.wikipedia.org/wiki/Zip_(file_format)#Encryption.

It is worth mentioning that the issue is with the encryption standards of the zip format, not with the zip command.

Also, the man page of zip notes this issue.

    -P password
       --password password
              Use  password  to  encrypt zipfile entries (if any).  THIS IS
              INSECURE!  Many multi-user operating systems provide ways for
              any  user  to see the current command line of any other user;
              even on stand-alone systems there is  always  the  threat  of
              over-the-shoulder peeking.  Storing the plaintext password as
              part of a command line in an automated script is even  worse.
              Whenever possible, use the non-echoing, interactive prompt to
              enter passwords.  (And where security is truly important, use
              strong  encryption such as Pretty Good Privacy instead of the
              relatively weak standard encryption provided by zipfile util‐
              ities.)

For more comprehensive documentation on this issue, take a look at this paper (written by a professor at my University :) ) https://homes.cs.washington.edu/~yoshi/papers/WinZip/winzip.pdf