Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I create an encrypted zip file with Winzip (say with 256 bit AES encryption), and some of the files contained in it have publicly known contents (e.g. open source 3rd party libraries), does this compromise the security of the encrypted zip at all?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

The original ZIP specification defines an encryption method that is incredibly easy to break, but many vendors have added their own encryption methods onto ZIP, like WinZip's AES that you mention, which is more widely implemented than any other ZIP encryption method.

In general, AES is very secure, but any algorithm can be compromised by a bad implementation. I have not heard of any problems with the WinZip implementation, and it has been compatibly reimplemented in some open-source tools (7-zip, for example), so I think there are probably enough eyes to assume that it's reasonably secure.

share|improve this answer

Of course it does, and especially now when AES is reported to have been cracked.

In this article, Has AES Been Cracked?, it says:

"This paper claimed to break the entire algorithm, and with only one or two known plaintexts,"

So : known plain-text + this little-known algorithm = easily cracking your stuff.

However, practically speaking, I don't think any application of this algorithm currently exists. For the moment.

share|improve this answer
    
That article is dated over seven years ago, and I haven't heard anything come of it. –  wfaulk Oct 9 '09 at 19:21
    
More data about the attack on Wikipedia: en.wikipedia.org/wiki/XSL_attack#Application_to_block_ciphers –  wfaulk Oct 9 '09 at 19:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.