Skip to main content
89 votes

Are 7-Zip password-protected split archives safe against hackers when they are password-protected a couple of times?

First of all, that multi-encryption scheme is ridiculous. The algorithm used by 7-Zip is AES-256 which is considered secure. But if someone would find a flaw in it which would make it breakable, then ...
Philipp's user avatar
  • 49.4k
40 votes

Is compression mandatory with TLS?

Compression is not mandatory in TLS. And in modern libraries or products, it is often disabled by default because of possible attack vectors like CRIME which rely on TLS level compression. Notably ...
Steffen Ullrich's user avatar
38 votes

Are 7-Zip password-protected split archives safe against hackers when they are password-protected a couple of times?

This is over engineering on a scale I've never seen. This is a BAD THING ™ because it increases the complexity of your solution without adding any security benefit. The encryption mechanism is either ...
A. Hersean's user avatar
  • 10.6k
28 votes

Are 7-Zip password-protected split archives safe against hackers when they are password-protected a couple of times?

First off, breathe. Encryption efforts often fails if you forget to breathe. Something about going unconscious causes us to have a hard time encrypting things! Second, it sounds like you are in ...
Cort Ammon's user avatar
  • 9,236
16 votes

Which encryption algorithm allows for the less output data than source data?

Encrypted data should be indistinguishable from random noise. Random data cannot be compressed. Therefore, compress data first and then encrypt it.
DarkMatter's user avatar
  • 2,691
14 votes
Accepted

Does it weaken the encryption of SSH to use compression?

Compression before encryption is a problem if the attacker can control parts of the transferred data and then use the detectable compression ratio (i.e. amount of transferred data vs. original data) ...
Steffen Ullrich's user avatar
13 votes

Encrypted password inside compressed archive

File compression utilities like Winrar or ZIP or 7zip encrypt the password and store it inside the archive. I don't know where you got this information (claims without source are always bad) but I'm ...
Steffen Ullrich's user avatar
12 votes

Which encryption algorithm allows for the less output data than source data?

No, what you are trying to accomplish is impossible. Encryption tries to keep information confidential. For this it takes one input message out of all possible input messages and encrypts in such a ...
Maarten Bodewes's user avatar
10 votes

Is compression mandatory with TLS?

Compression is not required, and support for it is up to the implementations on client and server. Not all servers or clients support it (it is mandatory to support uncompressed traffic). Some ...
CBHacking's user avatar
  • 48.5k
9 votes
Accepted

Brotli compression for HTTPS

support the new Brotli compression algorithm over HTTPS only. In theory yes. In practice Chrome will currently accept brotli compressed answers with plain HTTP too, even though it does not announce ...
Steffen Ullrich's user avatar
9 votes

How sensitive are acoustic side-channels to compression with a narrowband codec?

According to Wikipedia: "... G.711 passes audio signals in the range of 300–3400 Hz and samples them at the rate of 8,000" Nyquist criteria limits the top frequency to be less than half ...
user10216038's user avatar
  • 8,113
7 votes
Accepted

Encrypted password inside compressed archive

The password is required to decrypt the archive, so storing a copy of the password inside the archive would be pointless - anyone who could decrypt the archive already has the password. The only ...
Dr. Funk's user avatar
  • 196
6 votes
Accepted

What steganographic techniques can I use in images that survive lossy compression?

Yes there are, the techniques are often used more for watermarking but can also be used for steganography. One such technique is placing messages in frequency space via a 2-D Fourier Transform. ...
user10216038's user avatar
  • 8,113
6 votes
Accepted

Compression and Encryption against security issues

To exploit the compression, as in CRIME/BREACH, the attacker must perform a chosen-plaintext attack. In other terms, this means that the attacker must already have an exploit on your computer: Either ...
A. Hersean's user avatar
  • 10.6k
5 votes
Accepted

Encryption and Compression

There's no contradiction here as long as you consider the issue in probabilistic terms. For example: The reason I'm confused is that I thought that all encryption was supposed to do is make it as ...
Luis Casillas's user avatar
5 votes

What are the implications of reversing hashes

Reversible hashes aren't compression Even hashes which we can reverse cannot be used as a compression. Assuming that we could reverse sha256 wouldn't make current compression obsolete, because there ...
Peteris's user avatar
  • 8,419
5 votes
Accepted

Decryping a RAR file with same password

RAR uses AES256 for encryptionsource, thus the question is whether AES is cryptographically resistant to a known-plaintext attack. At present there is no known method that allows retrieving AES ...
techraf's user avatar
  • 9,149
4 votes

Encryption and compression of Data

Neither: Compress during encryption with an encryption tool designed to do both securely, such as GPG/OpenPGP. This is basically Thomas Pornin's answer just more direct, so readers in a hurry don't ...
hobs's user avatar
  • 161
4 votes

With BREACH attack, is session-based CSRF token still secure?

If your site is vulnerable to BREACH, an attacker can guess anything in the body of the response one character at a time. The attacker does multiple requests, one per guess, and can see if he guessed ...
Sjoerd's user avatar
  • 30.7k
4 votes

Are 7-Zip password-protected split archives safe against hackers when they are password-protected a couple of times?

I'm not as familiar with 7-Zip to fully understand its capabilities. However, assuming it is only a password-protected zip file, then no, this is not secure. However, I see some comments where 7-Zip ...
Andrew's user avatar
  • 381
4 votes
Accepted

SSL/TLS compression attacks on mail servers (smtp)

Compression attacks like CRIME and BREACH work by triggering repeated transmission of almost the same message with only slight modifications, with these modifications controlled by the attacker. By ...
Steffen Ullrich's user avatar
4 votes
Accepted

What is the algorithm for ARJ encrypted files?

By going to the vendor's site and looking up the manual, I found the different types of "encryption" they used: "0" indicates XOR garbling (archives created before 2.60). "1" indicates ...
schroeder's user avatar
  • 129k
4 votes
Accepted

How does CRIME work against cookies

If compression doesn't compress Cookies (as per RFC it compresses only the body and cookies are a part of the headers), how do the CRIME attack are even possible? CRIME does not work at the HTTP ...
Steffen Ullrich's user avatar
4 votes

How to protect websites against ZIP bombs and reference bombs?

Zip bombs are harmless if you don't extract them. Antivirus software will go through them a file at a time. You don't even need malice to get this effect - lots of poorly coded websites cause browsers ...
Therac's user avatar
  • 2,670
3 votes

Are 7-Zip password-protected split archives safe against hackers when they are password-protected a couple of times?

All the answers given so far are great! However, I think there is one possibility yet to be mentioned. I noticed in the original question that the OP mentioned password length (32-character passwords)...
Paul's user avatar
  • 41
3 votes

Various questions about file compression and encryption regarding hacking (zip, rar, 7z)

TL;DR; If the data is valuable, "slow down" will fix nothing. a script can be written to uncompress multi-level compression Brute force is possible. And also the password protection mechanism, using ...
mootmoot's user avatar
  • 2,397
3 votes
Accepted

Base64 or HEX encoded?

Base64 or HEX encoded? Hex. Base64 would show upper and lower characters as well as +, /, and =. This simply shows numbers and a single case of characters (implying case doesn't matter). Assuming ...
gowenfawr's user avatar
  • 72.9k
3 votes

.NET extraction and storage of compression files concerns

It has nothing much to do with .NET or IIS and make your mind clear about just you are in risk because of using MS products. When you get input from public, of any kind, you should act pessimistic. ...
Xaqron's user avatar
  • 306

Only top scored, non community-wiki answers of a minimum length are eligible