13

I have recently discovered an exploit, where I(or assuming anyone) can re-encrypt my encrypted zip file without having to know the password:

#zip --encrypt encrypted.zip -r dir1/

The above will prompt the user to enter a new password. Is there something I'm missing, or is this a known issue?

  • 5
    Have you found a way to read the data in the original zip file? – ctrl-alt-delor Dec 18 '18 at 20:24
  • @ctrl-alt-delor yes I didn't forget my password, I realised this by accident – lamino Dec 18 '18 at 20:40
  • 17
    Sorry I meant, Have you found a way to read the data in the original zip file, without knowing the password? – ctrl-alt-delor Dec 18 '18 at 20:53
40

Zip archives can have multiple passwords for different contained files. Files within an archive are essentially independent of each other - they are compressed without regard for other files, and they are encrypted in the same fashion. Your encrypted.zip will have two (or more) encrypted segments, one with your original password and one with the new one.

Trying to unzip the file would prompt for both passwords:

$ unzip ../test.zip
Archive:  ../test.zip
[../test.zip] file1 password:
  inflating: file1
  inflating: file2
[../test.zip] newfile password:
  inflating: newfile

The directory, the listing of file names, is not encrypted. This is not a bug, though it can be confusing and not all zip tools handle the situation well (particularly graphical tools).

  • 2
    Counter-intuitive but Interesting feature. Thanks for clarifying – lamino Dec 18 '18 at 20:10
  • 14
    The directory, the listing of file names, is not encrypted - this is why situations where the directory listing is also sensitive often have the original files zipped unencrypted into a zip file, which is then zipped and encrypted into another zip file. Then the only thing that is visible without the password is the name of the inner zip file. – Stobor Dec 19 '18 at 5:40
  • 2
    @Stobor on a related note, the .7z archive format has the option to encrypt the directory listing as well as the files. – user3490 Dec 19 '18 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.