I used this command to password protect a zip file on Linux :

zip -P 9000 hash.zip hash.py

and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 to 100000, the problem is that program find two password on it, first is: 9000 and the second is: 79095 , and both password unzip the file, is the any security vulnerability in Linux zip command?

  • How did you write a program that checks the passwords?
    – Thomas
    Mar 24, 2013 at 0:00
  • Program is in this link .baltar.blog.com/2013/03/23/… nothing too complecated.
    – user13934
    Mar 24, 2013 at 6:37

2 Answers 2


Both passwords may decrypt the file, but only one password will yield the correct plaintext. The zip encryption format is just checking to see if the padding is correct to verify that the correct key was used. The password 79095 produced valid padding, however the resulting message is garbage.

  • yes , second password return rubbish , and it said : bad CRC 61349fb8 (should be 29a0c89d)
    – user13934
    Mar 23, 2013 at 7:21
  • While in general this is valid, it's actually checking that the checksum byte(s) decrypted successfully. In Zip version 1, this value is the last 2 bytes of the encryption blob (which is a total of 12 bytes). In Zip 2.0+ this value is the last byte of the encryption blob. A comparison of the first block decrypted with your provided key is checked to see if it produces a plausibly-correct checksum. This allows zip to do a quick check that the password is possibly incorrect and thus not spin its wheels decrypting said rubbish. In short, it's not checking "padding" but something similar.
    – Nick
    Dec 2, 2014 at 22:20

See http://en.wikipedia.org/wiki/Zip_(file_format)#Encryption.

It is worth mentioning that the issue is with the encryption standards of the zip format, not with the zip command.

Also, the man page of zip notes this issue.

    -P password
       --password password
              Use  password  to  encrypt zipfile entries (if any).  THIS IS
              INSECURE!  Many multi-user operating systems provide ways for
              any  user  to see the current command line of any other user;
              even on stand-alone systems there is  always  the  threat  of
              over-the-shoulder peeking.  Storing the plaintext password as
              part of a command line in an automated script is even  worse.
              Whenever possible, use the non-echoing, interactive prompt to
              enter passwords.  (And where security is truly important, use
              strong  encryption such as Pretty Good Privacy instead of the
              relatively weak standard encryption provided by zipfile util‐

For more comprehensive documentation on this issue, take a look at this paper (written by a professor at my University :) ) https://homes.cs.washington.edu/~yoshi/papers/WinZip/winzip.pdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy