Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to find out what algorithm and key strength is used by Windows (XP) Explorer in order to explain why it isn't secure, but it does not seem to be detailed anywhere (Google only seems to give me offers of other software, and MS KB search is about as useful as a chocolate fireguard).

I presume it uses the PKZIP stream cipher, which certainly has documented weaknesses, but I'd like to also note if the key strength is too small to prevent brute force.

share|improve this question
3  
If you are worried about key strength use a program like 7ZIP which supports AES+256 –  Ramhound Feb 23 '12 at 18:54
1  
@Ramhound Yes, I'm trying to build the case for 7ZIP, which involves showing why the built-in functionality is insufficient. –  James Feb 23 '12 at 18:56
    
just did a test: win7 does not support aes256 for zip. so, there is your case :) –  akira Feb 23 '12 at 19:45
1  
@akira: Does Win7 even support password protected zip files at all? I'm almost positive it doesn't support creating them anymore because of the weaknesses. AFAIK, Win7 also doesn't support .zipx files either. –  afrazier Feb 23 '12 at 19:50
    
at least unzipping zips with pkzip-passwords works :) –  akira Feb 23 '12 at 19:57
add comment

1 Answer

I presume it uses the PKZIP stream cipher

AFAIK, you're correct about that. Given that XP was originally released in 2001, more powerful encryption methods for securing Zip files were extremely rare (if available at all). The only protection that could be applied that could be reasonably expected to be usable by all recipients would have been the old stream cipher. (Think: Recipients of these zip files running Windows 98/ME/2000 that had WinZip or PKZIP installed.)

I'd like to also note if the key strength is too small to prevent brute force.

The pkzip stream cipher is so completely broken it doesn't matter.

share|improve this answer
    
But it will obfuscate the mess out of an attachment in transport! :) –  Aaron Copley Feb 23 '12 at 19:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.