5

I'm trying to find out what algorithm and key strength is used by Windows (XP) Explorer in order to explain why it isn't secure, but it does not seem to be detailed anywhere (Google only seems to give me offers of other software, and MS KB search is about as useful as a chocolate fireguard).

I presume it uses the PKZIP stream cipher, which certainly has documented weaknesses, but I'd like to also note if the key strength is too small to prevent brute force.

5
  • 3
    If you are worried about key strength use a program like 7ZIP which supports AES+256
    – Ramhound
    Feb 23, 2012 at 18:54
  • 1
    @Ramhound Yes, I'm trying to build the case for 7ZIP, which involves showing why the built-in functionality is insufficient.
    – James
    Feb 23, 2012 at 18:56
  • just did a test: win7 does not support aes256 for zip. so, there is your case :)
    – akira
    Feb 23, 2012 at 19:45
  • 1
    @akira: Does Win7 even support password protected zip files at all? I'm almost positive it doesn't support creating them anymore because of the weaknesses. AFAIK, Win7 also doesn't support .zipx files either.
    – afrazier
    Feb 23, 2012 at 19:50
  • at least unzipping zips with pkzip-passwords works :)
    – akira
    Feb 23, 2012 at 19:57

1 Answer 1

4

I presume it uses the PKZIP stream cipher

AFAIK, you're correct about that. Given that XP was originally released in 2001, more powerful encryption methods for securing Zip files were extremely rare (if available at all). The only protection that could be applied that could be reasonably expected to be usable by all recipients would have been the old stream cipher. (Think: Recipients of these zip files running Windows 98/ME/2000 that had WinZip or PKZIP installed.)

I'd like to also note if the key strength is too small to prevent brute force.

The pkzip stream cipher is so completely broken it doesn't matter.

1
  • But it will obfuscate the mess out of an attachment in transport! :) Feb 23, 2012 at 19:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .