How strong is the encryption of a zip file in Linux Mint

Question

Zip encryption has had often a bad reputation of being weak, but some would argue that a zip file encrypted using certain algorithms (such as by using AES), together with strong password, is really safe (see: https://superuser.com/questions/145167/is-zips-encryption-really-bad )

My question is: how strong is the encryption of a zip file in Linux Mint 17.1, when one compress a file by right clicking on it in Nemo and then selecting the context "Compress..."? Does it use this same AES standard as recommended by the link above? Please assume a strong password using upper and lower case letters, numbers, symbols, 16+ digits and not a dictionary word.

Solution 1

File Roller (the GNOME application whose variant/fork/whatever-you-call-it you use) depends on zip.

That should not be the case - according to the fileroller news page, p7zip is used to create zip archives since version 2.23.4 - see this somewhat outdated fileroller news page.

It's also stated on 7-Zip's Wiki page:

7-Zip supports: The 256-bit AES cipher. Encryption can be enabled for both files and the 7z directory structure. When the directory structure is encrypted, users are required to supply a password to see the filenames contained within the archive. WinZip-developed zip file AES encryption standard is also available in 7-Zip to encrypt ZIP archives with AES 256-bit, but it does not offer filename encryption as in 7z archives.

Checking a standard-encrypted zip file from fileroller on the terminal shows:

7z l -slt [myStrongFile.zip]
-> Method = AES-128 Deflate

Where 7-Zip's own deflate algorithm applies (which yields better compression, too), according to the Wiki.

** If you want stronger encryption, you have two options: **

1. use the terminal and use the higher zip encrypt security option:

   7z a -p -mem=AES256 -tzip [myStrongerFile.zip] [fileToEncrypt1] [fileToEncrypt2] ...

Checking the encrypted 7z file on the terminal shows:

7z l -slt [myStrongerFile.zip]
-> Method = AES-256 Deflate

2. use the 7z format and encryption with fileroller, which also supports directory folder encryption, in contrary to zip files:

Checking the encrypted 7z file on the terminal shows:

7z l -slt [myStrongerFile.7z]
-> Method = LZMA:3m 7zAES:19

Which means AES-256

Solution 2

I'll just point out what the manpage of zip says about encryption (see description of --password):

....   (And  where security is truly important, use strong
encryption such as Pretty Good Privacy instead of the relatively
weak standard encryption provided by zipfile utilities.)

File Roller (the GNOME application whose variant/fork/whatever-you-call-it you use) depends on zip.

Comments

[gilbertohasnofb]

So in that case, there is a difference between the encryption standard of File Roller and a program like Winzip? The latter does use AES and states that it has a fairly strong encryption (source: kb.winzip.com/kb/entry/80 )

[muru]

@gilberto.agostinho.f yes. Nothing in the dependencies of zip suggests it's using aes (no plausible library), and if it rolls its own aes implementation, I'd stay away from it. Use gpg for encryption. That's the Unix way: dedicated tools. tar for the archiving, gzip for the compression, gpg for encryption.

[muru]

"That should not be the case"... well, that is the case. p7zip is only a recommended dependency, so it may not even be installed. And GNOME utilities underwent a significant overhaul in the 3.x releases, so I would take news from 2.x versions with a pinch of salt.