In modern zip utilities like 7zip, you can specify a password when creating a .ZIP file. But, how secure is this? What encryption algorithm(s) are used to secure password-protected zip files?
7-zip uses AES-256 encrpytion for 7z/zip archives.
7-Zip also supports encryption with AES-256 algorithm. This algorithm uses cipher key with length of 256 bits. To create that key 7-Zip uses derivation function based on SHA-256 hash algorithm. A key derivation function produces a derived key from text password defined by user. For increasing the cost of exhaustive search for passwords 7-Zip uses big number of iterations to produce cipher key from text password.
The help files of 7-zip says this about the security of a passworded 7z file:
Brute force attacks are a waste of time. I won't go into details why, I will instead direct you to Jeff Atwood's blog, he has an excellent post.
As secure as the length of the password:
From my personal experience trying to crack 7zip, password protected files by the combo of dictionary and brute-force attack the way to go is:
- Dictionary attack 200k^1
1.1 dictionary attack with the first letter capitalized 200k^1
1a. Dictionary and brute-force 3 digits at the back (
1a.1 Dictionary with the first letter capitalized and brute-force 3 digits at the back (
Less than an hour.
If above didn't fly you have less than 1 in 10 to crack with following (using
All numbers (0-9) 9 digits long (10^9) - will take about a day, will unlock all pins (
4-5digits) and all dates(
Latin lower and digits (a-z0-9) 6 symbols (25^6) will take about 2 days, have cracked some this way (
Latin lower and upper and digits and . and - (a-zA-Z0-9.-) 5 symbols (60^5) will take another day, have scored some (
After this point, it's a longshot (Nowadays I stop here)
- Dictionary combo 2 words 200k^2
4.1 Dictionary combo with 2 words first letter cap 200k^2
4.2 Dictionary combo 2 words space in between 200k^2
4.3 Dictionary combo with 2 words first letter cap space in between 200k^2
another two to three days
After this point just give up, lol