The second is AES-based encryption stored in the compression field in the metadata, and the third is AES-based encrypting using its own header format. The first is the legacy, highly-insecure ZipCrypto. The PKZip format supports three encryption methods. You must not rely on default, legacy Zip encryption. Nowadays, such an attack can be completed in seconds with free and publicly available tools. A research paper from 1994 showed that an attack against the underlying encryption can be done in several hours regardless of the strength of the password on a contemporary home PC. Aside from the fact that the filenames are unencrypted, the contents of a password-protected Zip file can be recovered if it uses the old, insecure ZipCrypto cipher which uses the insecure, non-cryptographic CRC algorithm for data confidentiality. You'd still be vulnerable to the attacks above to decrypt the data since the encryption is still "cheap lock" equivalent. The meta-data at the lower level should now be protected by the outer layer zip file. One way to protect against this is to simply zip up your files, and then zip-encrypt the resulting zip file again. Matching file sizes of the original files would only provide further evidence.
If the file names inside the zip file have names associated with copyrighted content, the copyright holder is going to assume the zip file contains copy-written content. This is extremely trivial to find without the password, and can be done using the command line zip utility to list the contents of the zip file. That means the filenames, file dates, file lengths, and directory names of all the files inside the zip file are all stored in the clear. The far easier scenario is the meta-data, which requires no cracking. Like a cheap lock, an attacker with a small degree of training could still break the underlying encryption. Encrypted zip files protect the data reasonably well (perhaps the equivalent of a cheap lock) but leak meta-data about the files inside the zip.
0 kommentar(er)
