Slashdot Mirror
PKWare and Winzip Reach A Secure Zip Compromise
richard_za writes "Until now the rival compression software vendors PKWare and Winzip have had different (incompatible) ways of password protecting the ZIP format. In a bid to prevent fragmentation of the standard they have agreed to have their software support opening of the other's files. They have however not agreed to support a single standard. PKZip's encryption is RSA-based while Winzip use an AES approach which is fully documented here.
The Register is running this story. PKWare has this press release."
I find zip files to be a pain in the butt anyway even without encryption.
if either program opens the others files the user wont (and shouldn't have to) give a shit which method is used.
"As long as it works"
You can't expect to wield supreme executive power, just because some watery tart threw a sword at you
Zip file management has virtually been absorbed into both Windows and Linux, and even if these two vendors agreed on a standard it would not mean much. PKzip became irrelevant when Infozip's portable zip tool became widely available, around 15 years ago. Further, all archiving tools today already deal with such a variety of formats that I can't see the crying need for a standard.
Ceci n'est pas une signature
There is still a problem with interoperability at the level of creating encrypted ZIP files. There is no longer a problem with interoperability at the level of reading encrypted ZIP files. The best way for this problem to go away would be for PKWARE to expand the SecureZIP standard to include RSA and AES encryption.
Call me a Troll, but I think the ZIP standard is outdated and bloated.
As for me I'm happy with the RAR compression.
It's smaller and well protected when it comes to encryption (AES).
In a bid to prevent fragmentation of the standard they have agreed to have their software support opening of the other's files. They have however not agreed to support a single standard. PKZip's encryption is RSA-based while Winzip use an AES
In other words, the standard is still fragmented, the new thing here is that both software now support both standard fragments, both double in size, and neither is more interesting for the end user than the other.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
BTW, the same doesn't quite hold true for PGP/GPG users because they use a key that includes much more entropy than which is derived from the password. Also, the password itself is useless in generating the key. If they choose lame passwords (or none at all), you'd still have to steal their key.
Every time someone sends you a zip archive that you need and that doesn't work because you don't have that particular Windows zip program X it will concern and annoy you.
Meh use tar/bzip2. That gets better compression than 7zip.
Someday, I'll have a real sig.
Actually I think this is one of the cases, where there is no need for asymmetric encryption at all.
That's only true if you are interested in creating an archive for your own future use. However, if you are interested in exchanging archives with other people, then you have the headache of key exchange, and assymetric encryption is quite useful. Probably most people who need to do this would prefer a solution that handles e-mail and other kinds of documents as well. However if you already have the public key infrastructure in place, it is probably going to be nice to use it for your zip archives too, in a belt-and-suspenders kind of way. I haven't looked at the PKZIP product, but the assymetric encryption should allow for digial signatures on archives as well, which would provide authentication and non-repudiaiton.
I'd say that the PKZip way would be more attractive to companies that need enteprise wide security and may have built it around RSA, and the WinZip way would be adequate for users who simply want to avoid having people poke around in their files.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
As plugins to existing applications are so popular these days, I see this issue as an irrelevance.
/path -Bxvf -
Both sides are competing using incompatible creeping featurism. Last I looked, Zip applications where supposed to combine and squash files (and that was enough).
What should be done is to separate the operations:
- file browsing (WinRAR's interface trumps both)
- archiving (combining files)
- compression
- encryption
and implement the latter three as functions of the first using plugins (and let the user choose).
Incidentally, Zip's file format (directory last) sucks. It is practically impossible to do the following using zip:
tar Bcf - . | gzip -1c | rsh -n over_there gzip -dc | tar -C
To this end, plugins suggested above should be written as filters where possible.
I have no problem with browser-like interfaces combining other functions, but the Golden Rule still stands: One Tool, One Job.
The downside to RAR is that the format isn't stable.
Since I don't keep up with the warez scene, on the very rare occasion that I download a RAR it's invariably incompatible with whatever version of WinRAR I have installed. Then I need to go download and install their new shareware crapola, fight with it's file assocations and explorer plugins and so on.
Nice thing about Zip is that it hasn't really changed since the early 90s.
If you want encryption on a per-file basis - again, use GPG on individual files before or after archiving.
Compression after encryption = 0 bytes saved. There's too much random data to compress anything.
However, encrypting after compression is a different story...