up vote 8 down vote favorite
3
share [g+] share [fb]

In modern zip utilities like 7zip, you can specify a password when creating a .ZIP file. But, how secure is this? What encryption algorithm(s) are used to secure password-protected zip files?

link|improve this question
feedback

3 Answers

up vote 8 down vote accepted

7-zip uses AES-256 encrpytion for 7z/zip archives.

http://7-zip.org/7z.html says:

7-Zip also supports encryption with AES-256 algorithm. This algorithm uses cipher key with length of 256 bits. To create that key 7-Zip uses derivation function based on SHA-256 hash algorithm. A key derivation function produces a derived key from text password defined by user. For increasing the cost of exhaustive search for passwords 7-Zip uses big number of iterations to produce cipher key from text password.

The help files of 7-zip says this about the security of a passworded 7z file:

7z

link|improve this answer
feedback
up vote 3 down vote

Brute force attacks are a waste of time. I won't go into details why, I will instead direct you to Jeff Atwood's blog, he has an excellent post.

link|improve this answer
3  
Brute force attacks aren't always a waste of time, most users don't put an awful lot of thought into passwords, and a dictionary attack against the password they use can be a very effective way to decrypt a file. A brute force attack is only a waste of time (at present it becomes easier by the year) against a secure key. – Mike1980 Apr 10 '10 at 17:21
Indeed, I once, (just out of curiosity!) took the whole-school list of user accounts from a very poorly CC'd email and wrote a quick python script to dictionary-attack each of them. Got an average of 3 hours/account, and that's over the internet. Had I had a local method of doing this, it would have been much much faster - dictionary words are not safe. – Phoshi Apr 10 '10 at 19:55
3  
A brute force attack is a waste of time. Dictionary attacks are not brute force, and are a LOT faster than trying every possible combination of a set of characters up to a specific length. – Mircea Chirea Apr 10 '10 at 21:10
+1 For posting a link to a blog with a link to a blog with that discusses an email that pertains to the original question. – Oorang Jul 25 '10 at 0:36
@Oorang, I did that on purpose :P – Mircea Chirea Jul 26 '10 at 7:26
show 1 more comment
feedback
up vote -4 down vote

I don't know. I guess if you specify a huge password (30 chars +) they will be quite secure.

link|improve this answer
If you don't know you shouldn't post anything as an answer. Just add a comment instead. – Aznfin Apr 10 '10 at 18:12
Well judging by the first answer what I said is correct. If you use a huge password it's almost impossible to crack it by conventional means. – ULTRA_POROV Apr 11 '10 at 15:32
1  
Unless the program uses a weak algorithm (ZIP2.0), in which case "conventional means" work very well. – grawity Apr 11 '10 at 20:42
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.