Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 19 down vote favorite
4

In modern zip utilities like 7zip, you can specify a password when creating a .ZIP file. But, how secure is this? What encryption algorithm(s) are used to secure password-protected zip files?

share|improve this question

2 Answers

up vote 20 down vote accepted

7-zip uses AES-256 encrpytion for 7z/zip archives.

http://7-zip.org/7z.html says:

7-Zip also supports encryption with AES-256 algorithm. This algorithm uses cipher key with length of 256 bits. To create that key 7-Zip uses derivation function based on SHA-256 hash algorithm. A key derivation function produces a derived key from text password defined by user. For increasing the cost of exhaustive search for passwords 7-Zip uses big number of iterations to produce cipher key from text password.

The help files of 7-zip says this about the security of a passworded 7z file:

7z

share|improve this answer
up vote 3 down vote

Brute force attacks are a waste of time. I won't go into details why, I will instead direct you to Jeff Atwood's blog, he has an excellent post.

share|improve this answer
4  
Brute force attacks aren't always a waste of time, most users don't put an awful lot of thought into passwords, and a dictionary attack against the password they use can be a very effective way to decrypt a file. A brute force attack is only a waste of time (at present it becomes easier by the year) against a secure key. – Mike1980 Apr 10 '10 at 17:21
Indeed, I once, (just out of curiosity!) took the whole-school list of user accounts from a very poorly CC'd email and wrote a quick python script to dictionary-attack each of them. Got an average of 3 hours/account, and that's over the internet. Had I had a local method of doing this, it would have been much much faster - dictionary words are not safe. – Phoshi Apr 10 '10 at 19:55
3  
A brute force attack is a waste of time. Dictionary attacks are not brute force, and are a LOT faster than trying every possible combination of a set of characters up to a specific length. – Mircea Chirea Apr 10 '10 at 21:10
+1 For posting a link to a blog with a link to a blog with that discusses an email that pertains to the original question. – Oorang Jul 25 '10 at 0:36
@Oorang, I did that on purpose :P – Mircea Chirea Jul 26 '10 at 7:26
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.