15

Using command line, I know that I can encrypt a directory with the following command:

zip -er Directory.zip /path/to/directory

However, this does not encrypt the filenames themselves. If someone runs:

unzip Directory.zip

and repeatedly enters a wrong password, the unzip command will loop through all of the contained filenames until the correct password is entered. Sample output:

unzip Directory.zip 
Archive:  Directory.zip
   creating: Directory/
[Directory.zip] Directory/sensitive-file-name-1 password: 
password incorrect--reenter: 
password incorrect--reenter: 
   skipping: Directory/sensitive-file-name-1  incorrect password
[Directory.zip] Directory/sensitive-file-name-2 password: 
password incorrect--reenter: 
password incorrect--reenter: 
   skipping: Directory/sensitive-file-name-2  incorrect password
[Directory.zip] Directory/sensitive-file-name-3 password: 
password incorrect--reenter: 
password incorrect--reenter: 
   skipping: Directory/sensitive-file-name-3  incorrect password

and so on.

Using command line, is there a way to zip a directory with encryption while also encrypting or hiding the filenames themselves?

Thank you.

22

In a zip file, only file contents is encrypted. File metadata, including file names, is not encrypted. That's a limitation of the file format: each entry is compressed separately, and if encrypted, encrypted separately.

You can use 7-zip instead. It supports metadata encryption (-mhe=on with the Linux command line implementation).

7z a -p -mhe=on Directory.7z /path/to/directory

There are 7zip implementations for all major operating systems and most minor ones but that might require installing extra software (IIRC Windows can unzip encrypted zip files off the box these days). If requiring 7z for decryption is a problem, you can rely on zip only by first using it to pack the directory in a single file, and then encrypting that file. If you do that, turn off compression of individual files and instruct the outer zip to compress the zip file, you'll get a better compression ratio overall.

zip -0 -r Directory.zip /path/to/directory
zip -e -n : encrypted.zip Directory.zip
  • 1
    Probably best to avoid using zip to encrypt - one can use 7zip to generate a more securely encrypted (AES) zipfile on the 2nd line: 7z a -p -tzip encrypted.zip Directory.zip – Pierz Mar 19 '18 at 12:51
2

You could create an archive using your favorite tool and then use bcrypt to perform encryption/decryption.

A) To create an encrypted file:

tar -czf Directory.tgz /path/to/directory
bcrypt Directory.tgz

This will give you a Blowfish-encrypted file Directory.tgz

B) To reverse this process:

bcrypt Directory.tgz.bfe
tar -xf Directory.tgz
  • 2
    The approach is good, but you should use another tool for encryption — bcrypt uses EBC which reveals structure in the encrypted data. See Debian bug #700758 for details (Debian's bcrypt only supports decryption as a result). – Stephen Kitt Jun 16 '16 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.