If I create an encrypted zip file with Winzip (say with 256 bit AES encryption), and some of the files contained in it have publicly known contents (e.g. open source 3rd party libraries), does this compromise the security of the encrypted zip at all?
2 Answers
The original ZIP specification defines an encryption method that is incredibly easy to break, but many vendors have added their own encryption methods onto ZIP, like WinZip's AES that you mention, which is more widely implemented than any other ZIP encryption method.
In general, AES is very secure, but any algorithm can be compromised by a bad implementation. I have not heard of any problems with the WinZip implementation, and it has been compatibly reimplemented in some open-source tools (7-zip, for example), so I think there are probably enough eyes to assume that it's reasonably secure.
Of course it does, and especially now when AES is reported to have been cracked.
In this article, Has AES Been Cracked?, it says:
"This paper claimed to break the entire algorithm, and with only one or two known plaintexts,"
So : known plain-text + this little-known algorithm = easily cracking your stuff.
However, practically speaking, I don't think any application of this algorithm currently exists. For the moment.
-
That article is dated over seven years ago, and I haven't heard anything come of it.– wfaulkOct 9, 2009 at 19:21
-
More data about the attack on Wikipedia: en.wikipedia.org/wiki/XSL_attack#Application_to_block_ciphers– wfaulkOct 9, 2009 at 19:26