Hot answers tagged

17

In CBC mode, the Initialization Vector (IV) has to meet two properties: Uniqueness: Here the IV is very likely unique because of time(NULL) and gettimeofday() which are basically the current time of your system. It's even more likely on Windows platform since the CPU cycle is involved. Unpredictability: This property is mandatory if the user can choose the ...


3

Generally speaking, the answer is no. There's a risk that a malicious archive will exploit a bug in your archive software to open a file, but if your software has such a bug then attempting to execute a script is actually relatively safe, as there's lots of ways to block that (you'd have fewer options it if just ran an executable or took over the archive ...


3

No, attempting to extract files from within a malicious EXE is not dangerous, unless there's a vulnerability in the tools you use and the malicious EXE is crafted to exploit that vulnerability. In general, for tools that are meant to be able to safely open files from arbitrary sources (and yes, unzip tools fall into this category), the only time opening a ...


3

7-zip uses AES-256 for 7z archives, the strongest version of AES. WinZip offers two kinds of encryption: AES encryption (It's good, but windows doesn't support it.) and weak Zip 2.0 (Legacy) encryption, which is the old method. Windows supports it. But that method provides low security level. Do not rely on Zip 2.0 encryption to provide strong data security....


3

7-Zip added AES-256 support (for the 7z format) in version “2.30 Beta 25” (January 2003) and the necessary support for its (somewhat) “random” IVs in version “4.48 beta” (June 2007). AES is a block cipher, which means that it “translates” one block of unencrypted data (plaintext) to one block of encrypted data (ciphertext) during encryption. Without ...


2

Compression would affect the encryption if the attacker controls some plaintext of the encrypted data as mentioned in this post. It may not have an influence for your use case, since the data is archived and not accessed by many people, but if it is sensitive data then spare the extra GB for more security.


2

7zip is secure since it uses AES-256 in CBC mode that can provide CPA security and there is no problem there. Keep in mind that CBC has no integrity and authentication. The real problem comes from the human side; the password! 7zip uses 219-times iterated SHA256 to derive the AES-256 key from passwords. SHA256 is not a memory-hard function and therefore this ...


1

This is the classic weapon/armor problem. Sysadmins do their best to reject content that they think possibly harmfull, while users do their best to hide their data. Here the most probable detection way used to detect the real content is the name of the file which is (by default) left unencrypted when you put it in an encrypted zip file. So on a public ...


1

The information that you are seeing may be referring to known bugs that were reported in 2019 concerning weak random number generation, and a flaw in the way that the IV is generated, in versions of 7zip at that time: https://threadreaderapp.com/thread/1087848040583626753.html https://sourceforge.net/p/sevenzip/bugs/2176/ It seems that these bugs have been ...


1

TL;DR: You are fine, generate a long password (60+ chars), send the file by mail and the password by SMS, fax, snail-mail or phone call. Does this mean that 7ZIP encryption is basically useless? Short answer: No. Long answer: It depends on the password. A password cracker just tries passwords over and over again, either by trying all words on a dictionary (...


1

Password crackers are basically programs that take a massive password list and bruteforce the zip file in hopes of getting a positive hit (right password). Quick fix is to just set up a strong password that has a probability of not being in a password list (Recommended to use a random password generator with min. 20 characters, alphanumeric, upper and lower ...


Only top voted, non community-wiki answers of a minimum length are eligible