Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I create an encrypted zip file with Winzip (say with 256 bit AES encryption), and some of the files contained in it have publicly known contents (e.g. open source 3rd party libraries), does this compromise the security of the encrypted zip at all?

share|improve this question
up vote 4 down vote accepted

The original ZIP specification defines an encryption method that is incredibly easy to break, but many vendors have added their own encryption methods onto ZIP, like WinZip's AES that you mention, which is more widely implemented than any other ZIP encryption method.

In general, AES is very secure, but any algorithm can be compromised by a bad implementation. I have not heard of any problems with the WinZip implementation, and it has been compatibly reimplemented in some open-source tools (7-zip, for example), so I think there are probably enough eyes to assume that it's reasonably secure.

share|improve this answer

Of course it does, and especially now when AES is reported to have been cracked.

In this article, Has AES Been Cracked?, it says:

"This paper claimed to break the entire algorithm, and with only one or two known plaintexts,"

So : known plain-text + this little-known algorithm = easily cracking your stuff.

However, practically speaking, I don't think any application of this algorithm currently exists. For the moment.

share|improve this answer
That article is dated over seven years ago, and I haven't heard anything come of it. – wfaulk Oct 9 '09 at 19:21
More data about the attack on Wikipedia: – wfaulk Oct 9 '09 at 19:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .