search

aonez / Keka

The macOS & iOS file archiver
https://www.keka.io
4.71k stars 236 forks source link

Encryption method and password length not flagged [BUG] #1079

Open dcblack opened 2 years ago

dcblack commented 2 years ago

Configuration

Describe the bug

For anybody that care about security, there are some warnings that should be issued:

  1. ZipCrypto (i.e., classic Zip encryption) is unsafe.
  2. AES encryption needs a decently long password depending on key length (e.g., 128-bit => 23 characters). So anything less should issue a warning dialog.
  3. Oddly, Windows 10 7-Zip won't allow passwords longer than 63 characters apparently, which makes interoperability an issues and should issue a warning.

To Reproduce

Steps to reproduce the behavior:

  1. Try encrypting for defacto ZipCrypto
  2. Try encrypting with a short password for AES
  3. Try encrypting with a long password for AES

Expected behavior

I expect warning messages that encourage security.

Current behavior

I get a warning recommending away from AES encryption and no issues with password length.

Additional information

On Windows 10, 7-Zip supports AES and it's free.

aonez commented 2 years ago

Very interesting issue.

  1. ZipCrypto (i.e., classic Zip encryption) is unsafe.

Most users want the most compatible encrypted file and that's why ZipCrypto is still the default for ZIP and a warning is shown when using AES https://github.com/aonez/Keka/issues/363. Indeed is not a bad idea to add some warning/tip noting that ZipCrypto is widely supported but a legacy, less safe option so users have the opportunity to read about it.

2. AES encryption needs a decently long password depending on key length (e.g., 128-bit => 23 characters). So anything less should issue a warning dialog.

Was not aware of that one. Can you provide some reference?

3. Oddly, Windows 10 7-Zip won't allow passwords longer than 63 characters apparently, which makes interoperability an issues and should issue a warning.

I'm unable to reproduce this one with 7-Zip in Windows. Tried with 90+ characters passwords, both in ZipCrypto and AES and all worked properly. It does indeed fail with bundled Windows extraction limited support of ZIP (ZipCrypto only), so you're right a warning should be issues when using both ZipCrypto and passwords longer than 63 characters.