WirelessAlien / ZipXtract

A fully open source app to extract rar, zip, tar, bz2, gz, 7z, xz, jar and z etc (encrypted .zip & .7z supported)
GNU General Public License v3.0
351 stars 14 forks source link

[FEATURE]Security Question #25

Open PorcelainSky opened 7 months ago

PorcelainSky commented 7 months ago

The Zip standard encryption method has been proven to be no longer safe and has broken weaknesses more than ten years ago. It is recommended to remove this encryption algorithm. For AES encryption, can I add aes128gcm, aes192gcm, and aes256gcm to choose from? Can ChaCha20-Poly1305/XChaCha20-Poly1305 be added to devices with weak performance? Or AEGIS256/128L etc. (libsodium)

PorcelainSky commented 7 months ago

https://github.com/jedisct1/libaegis https://doc.libsodium.org/secret-key_cryptography/aead/aegis-256

PorcelainSky commented 7 months ago

In addition, this is a crash log during encryption and compression. When entering the password and clicking compression, a crash occurred. Android 10 ZipXtract_Crash_Log.txt

WirelessAlien commented 7 months ago

In addition, this is a crash log during encryption and compression. When entering the password and clicking compression, a crash occurred. Android 10 ZipXtract_Crash_Log.txt

Did you select compression method - AES_INTERNAL_ONLY ? If yes I actually got that issue before but forgot to removed that parameter.

WirelessAlien commented 7 months ago

The Zip standard encryption method has been proven to be no longer safe and has broken weaknesses more than ten years ago. It is recommended to remove this encryption algorithm.

Yeah, it can be removed or maybe not completely removed, but a warning that it is not safe to use, remove from the default method.

For AES encryption, can I add aes128gcm, aes192gcm, and aes256gcm to choose from?

Yeah, Sure.

Can ChaCha20-Poly1305/XChaCha20-Poly1305 be added to devices with weak performance? Or AEGIS256/128L etc. (libsodium)

Maybe, I am not sure about this, will see what can be done.

PorcelainSky commented 7 months ago

In addition, this is a crash log during encryption and compression. When entering the password and clicking compression, a crash occurred. Android 10 ZipXtract_Crash_Log.txt

Did you select compression method - AES_INTERNAL_ONLY ? If yes I actually got that issue before but forgot to removed that parameter.

Yes, I retried the deflate compression algorithm and it worked successfully.

PorcelainSky commented 7 months ago

Zip 标准加密方法已被证明不再安全,并且在十多年前就已突破弱点。建议删除该加密算法。

是的,它可以被删除,也可能不能完全删除,但会警告它使用起来不安全,请从默认方法中删除。

对于 AES 加密,我可以添加 aes128gcm、aes192gcm 和 aes256gcm 供选择吗?

好,当然。

ChaCha20-Poly1305/XChaCha20-Poly1305可以添加到性能较弱的设备中

The Zip standard encryption method has been proven to be no longer safe and has broken weaknesses more than ten years ago. It is recommended to remove this encryption algorithm.

Yeah, it can be removed or maybe not completely removed, but a warning that it is not safe to use, remove from the default method.

For AES encryption, can I add aes128gcm, aes192gcm, and aes256gcm to choose from?

Yeah, Sure.

Can ChaCha20-Poly1305/XChaCha20-Poly1305 be added to devices with weak performance? Or AEGIS256/128L etc. (libsodium)

Maybe, I am not sure about this, will see what can be done.

grateful! Looking forward to what happens next.

PorcelainSky commented 7 months ago

The Zip standard encryption method has been proven to be no longer safe and has broken weaknesses more than ten years ago. It is recommended to remove this encryption algorithm.

Yeah, it can be removed or maybe not completely removed, but a warning that it is not safe to use, remove from the default method.

For AES encryption, can I add aes128gcm, aes192gcm, and aes256gcm to choose from?

Yeah, Sure.

Can ChaCha20-Poly1305/XChaCha20-Poly1305 be added to devices with weak performance? Or AEGIS256/128L etc. (libsodium)

Maybe, I am not sure about this, will see what can be done.

Sorry, I may have confused you. There may be a problem with the translation software. I mean can you provide/add AES128GCM, AES192GCM, AES256GCM options in future versions.

WirelessAlien commented 7 months ago

The Zip standard encryption method has been proven to be no longer safe and has broken weaknesses more than ten years ago. It is recommended to remove this encryption algorithm.

Yeah, it can be removed or maybe not completely removed, but a warning that it is not safe to use, remove from the default method.

For AES encryption, can I add aes128gcm, aes192gcm, and aes256gcm to choose from?

Yeah, Sure.

Can ChaCha20-Poly1305/XChaCha20-Poly1305 be added to devices with weak performance? Or AEGIS256/128L etc. (libsodium)

Maybe, I am not sure about this, will see what can be done.

Sorry, I may have confused you. There may be a problem with the translation software. I mean can you provide/add AES128GCM, AES192GCM, AES256GCM options in future versions.

Ooh, Ok. It will be added 👍