<story><title>7-zip broken password random number generator</title><url>https://threadreaderapp.com/thread/1087848040583626753.html</url></story><parent_chain></parent_chain><comment><author>tptacek</author><text>This is getting a lot of play today on Twitter but it&amp;#x27;s not all that consequential in the normal setting of a ZIP file.&lt;p&gt;The flaw they&amp;#x27;re pointing out is that 7z&amp;#x27;s AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability &lt;i&gt;in block ciphers&lt;/i&gt; --- and uses a predictable RNG to generate the IV (for simplicity, just call it &amp;quot;time and pid&amp;quot;). 7z uses AES in CBC mode.&lt;p&gt;In CBC, you want IVs to be unpredictable; if you can predict an IV &lt;i&gt;and&lt;/i&gt; you control some of the plaintext, you can in some cases make predictions about secret data that follows your controlled plaintext (this is an &amp;quot;adaptive chosen plaintext&amp;quot; attack).&lt;p&gt;This doesn&amp;#x27;t really come up in 7z&amp;#x27;s usage model; you&amp;#x27;re supposing someone integrates 7z with their own application, which, on-demand, encrypts attacker-controlled data with a secret suffix and puts it somewhere the same attacker can see the resulting ciphertext. Don&amp;#x27;t do this. In fact, if you&amp;#x27;re using ZIP archives in your application, don&amp;#x27;t use ZIP&amp;#x27;s AES at all; encrypt yourself with a modern mode. ZIP AES isn&amp;#x27;t meaningfully authenticated.&lt;p&gt;Having said all that: for the normal usage of an encrypted ZIP, this doesn&amp;#x27;t really matter at all.&lt;p&gt;It&amp;#x27;s a good finding, though! Cheers to anyone who takes the time to look at the underlying code for any popular cryptography. I hope they keep it up.&lt;p&gt;A more important PSA: unless you&amp;#x27;re absolutely sure otherwise, you should always assume any ZIP program you&amp;#x27;re using doesn&amp;#x27;t actually encrypt password-protected ZIPs. It&amp;#x27;s just as likely that it&amp;#x27;s using the old, broken PKWARE cipher, which is dispiritingly common due to backwards-compat concerns. It would be nice if there was a mainstream, built-in way to password-protect a file that you could share with someone else (or just stick on a thumb drive), but ZIP encryption isn&amp;#x27;t it.&lt;p&gt;Pentesters sometimes go out of their way to use 7z because it actually does encrypt with a real cipher. And, I guess for what we&amp;#x27;re doing with it, 7z is fine. But it&amp;#x27;s sad that it&amp;#x27;s the best common denominator we have.</text></comment>
<story><title>7-zip broken password random number generator</title><url>https://threadreaderapp.com/thread/1087848040583626753.html</url></story><parent_chain></parent_chain><comment><author>deckar01</author><text>It is not clear if anything is actually wrong here. It would be nice if someone who has spent more than &amp;quot;30 minutes&amp;quot; looking at this code could verify these claims and publish an article explaining the implications of these design choices.&lt;p&gt;The twitter thread that this is aggregated from has replies that seem to indicate that there is no practical exploit here.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;3lbios&amp;#x2F;status&amp;#x2F;1087848040583626753&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;3lbios&amp;#x2F;status&amp;#x2F;1087848040583626753&lt;/a&gt;</text></comment>