13

I have recently discovered an exploit, where I(or assuming anyone) can re-encrypt my encrypted zip file without having to know the password:

#zip --encrypt encrypted.zip -r dir1/

The above will prompt the user to enter a new password. Is there something I'm missing, or is this a known issue?

3
  • 5
    Have you found a way to read the data in the original zip file? Dec 18, 2018 at 20:24
  • @ctrl-alt-delor yes I didn't forget my password, I realised this by accident
    – lamino
    Dec 18, 2018 at 20:40
  • 17
    Sorry I meant, Have you found a way to read the data in the original zip file, without knowing the password? Dec 18, 2018 at 20:53

1 Answer 1

41

Zip archives can have multiple passwords for different contained files. Files within an archive are essentially independent of each other - they are compressed without regard for other files, and they are encrypted in the same fashion. Your encrypted.zip will have two (or more) encrypted segments, one with your original password and one with the new one.

Trying to unzip the file would prompt for both passwords:

$ unzip ../test.zip
Archive:  ../test.zip
[../test.zip] file1 password:
  inflating: file1
  inflating: file2
[../test.zip] newfile password:
  inflating: newfile

The directory, the listing of file names, is not encrypted. This is not a bug, though it can be confusing and not all zip tools handle the situation well (particularly graphical tools).

3
  • 2
    Counter-intuitive but Interesting feature. Thanks for clarifying
    – lamino
    Dec 18, 2018 at 20:10
  • 14
    The directory, the listing of file names, is not encrypted - this is why situations where the directory listing is also sensitive often have the original files zipped unencrypted into a zip file, which is then zipped and encrypted into another zip file. Then the only thing that is visible without the password is the name of the inner zip file.
    – Stobor
    Dec 19, 2018 at 5:40
  • 2
    @Stobor on a related note, the .7z archive format has the option to encrypt the directory listing as well as the files.
    – user3490
    Dec 19, 2018 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .