Do Windows 8.1 or 10 support AES-256 in zip files?

Question

I am aware that many versions of Windows do not have built-in explorer support for zip files (PKZip format) that use AES-256 encryption as opposed to the broken zip crypto. In particular I have tried it on Windows 7 and Server 2012 and it doesn't work on either.

I don't have access to test newer Windows versions. Can users of Windows 8.1 and/or Windows 10 extract AES-256 encrypted files in zip archives using Windows Explorer or anything that comes with the OS? (I know they can do so by installing freely available programs, but don't want to require them to do so if it's not necessary.)

Solution 1

I tried this right now. I used 7-Zip to create an AES-256 encrypted *.zip (PKZip) file and then open it in Windows 10 File Explorer.

I'm using Windows 10 1709 (OS build 16299.125) aka "Fall Creator's Update".

File Explorer listed the files in the zip file correctly (this is expected as zip files do not encrypt filenames), but gave me an error when attempting to extract a file:

An unexpected error is keeping you from copying the file. If you continue to receive this error, you can use the error code to search for help with this problem.

Error 0x80004005: Unspecified error

So, no, Windows 10 (and presumably Windows 8.1, 8.0, 7, etc) does not support AES-256 encryption in zip files - however the "ZipCrypto" mode in 7-Zip does seem to be supported.

Solution 2

The question, though old, asked about PKZip format so I thought I'd test the AES 256 encryption method used by PKZIP instead of WinZip/7zip since they are different and also not the same as traditional "ZipCrypto" referenced by 7zip. The file format is the same, but the exact encryption implementation used by the PKZip application are different.

I tested a PKWARE AES 256 encrypted zip file. It was made by an evaluation version of PKZIP 14.40.0028 and has 0x10 0x66 for the Algorithm ID (according to PKZIP), and testing with 7zip's command line revealed:

7z l -slt pkzip.zip
...
Method = pkAES-256 Deflate
Characteristics = NTFS StrongCrypto : Encrypt StrongCrypto UTF8
...

Compare to a 7zip encrypted zip with AES 256 which uses WinZip AES 256 algorithm and has 0x03 0x08 for the Algorithm ID (according to PKZIP).

7z l -slt 7zip.zip
...
Method = AES-256 Deflate:Maximum
Characteristics = WzAES : Encrypt
...

In both cases my Windows 10 Home version 20H2 cannot decrypt it. For the WzAES 256 zip my error is

Windows cannot complete the extraction.

The destination file could not be created.

While the pkAES-256 file simply keeps thinking I'm giving it an invalid password:

The password that you typed is not correct. Try typing it again.

Windows 10 still does not appear to natively support Zip AES encryption, whether it is PKWARE AES 256 or WinZip AES 256.

Comments

[Ramhound]

This feature set hasn’t changed since it was introduced into Windows

[Xen2050]

If you really want secure encryption then use a real (tested, trusted) encryption program (like gpg/pgp) that can stump a government. I wouldn't trust an "encrypted" zip file to stop more than children, even if it uses a decent algorithm it's implementation could easily be terrible and undiscovered bugs legion.

[NetMage]

I think it is important to note that ZipCrypto mode is the broken ecryption referred to in the OP. It can't be trusted.

[DAG]

Windows 10 1803 also does not decrypt AES-256 zip files