<story><title>7-zip broken password random number generator</title><url>https://threadreaderapp.com/thread/1087848040583626753.html</url></story><parent_chain><item><author>tptacek</author><text>This is getting a lot of play today on Twitter but it&amp;#x27;s not all that consequential in the normal setting of a ZIP file.&lt;p&gt;The flaw they&amp;#x27;re pointing out is that 7z&amp;#x27;s AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability &lt;i&gt;in block ciphers&lt;/i&gt; --- and uses a predictable RNG to generate the IV (for simplicity, just call it &amp;quot;time and pid&amp;quot;). 7z uses AES in CBC mode.&lt;p&gt;In CBC, you want IVs to be unpredictable; if you can predict an IV &lt;i&gt;and&lt;/i&gt; you control some of the plaintext, you can in some cases make predictions about secret data that follows your controlled plaintext (this is an &amp;quot;adaptive chosen plaintext&amp;quot; attack).&lt;p&gt;This doesn&amp;#x27;t really come up in 7z&amp;#x27;s usage model; you&amp;#x27;re supposing someone integrates 7z with their own application, which, on-demand, encrypts attacker-controlled data with a secret suffix and puts it somewhere the same attacker can see the resulting ciphertext. Don&amp;#x27;t do this. In fact, if you&amp;#x27;re using ZIP archives in your application, don&amp;#x27;t use ZIP&amp;#x27;s AES at all; encrypt yourself with a modern mode. ZIP AES isn&amp;#x27;t meaningfully authenticated.&lt;p&gt;Having said all that: for the normal usage of an encrypted ZIP, this doesn&amp;#x27;t really matter at all.&lt;p&gt;It&amp;#x27;s a good finding, though! Cheers to anyone who takes the time to look at the underlying code for any popular cryptography. I hope they keep it up.&lt;p&gt;A more important PSA: unless you&amp;#x27;re absolutely sure otherwise, you should always assume any ZIP program you&amp;#x27;re using doesn&amp;#x27;t actually encrypt password-protected ZIPs. It&amp;#x27;s just as likely that it&amp;#x27;s using the old, broken PKWARE cipher, which is dispiritingly common due to backwards-compat concerns. It would be nice if there was a mainstream, built-in way to password-protect a file that you could share with someone else (or just stick on a thumb drive), but ZIP encryption isn&amp;#x27;t it.&lt;p&gt;Pentesters sometimes go out of their way to use 7z because it actually does encrypt with a real cipher. And, I guess for what we&amp;#x27;re doing with it, 7z is fine. But it&amp;#x27;s sad that it&amp;#x27;s the best common denominator we have.</text></item></parent_chain><comment><author>13of40</author><text>&amp;gt; It would be nice if there was a mainstream, built-in way to password-protect a file that you could share with someone else&lt;p&gt;This is going to sound really ghetto, but if you zip up some files, drag and drop the zip archive into a (modern) Word document, then pick File-&amp;gt;Info-&amp;gt;Protect Document-&amp;gt;Encrypt With Password, you end up with a shareable file with decent encryption.  IIRC, key generation is done with 500,000 rounds of SHA512 (which takes about 0.8 seconds on a contemporary CPU) and the encryption is 256-bit AES.</text></comment>
<story><title>7-zip broken password random number generator</title><url>https://threadreaderapp.com/thread/1087848040583626753.html</url></story><parent_chain><item><author>tptacek</author><text>This is getting a lot of play today on Twitter but it&amp;#x27;s not all that consequential in the normal setting of a ZIP file.&lt;p&gt;The flaw they&amp;#x27;re pointing out is that 7z&amp;#x27;s AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability &lt;i&gt;in block ciphers&lt;/i&gt; --- and uses a predictable RNG to generate the IV (for simplicity, just call it &amp;quot;time and pid&amp;quot;). 7z uses AES in CBC mode.&lt;p&gt;In CBC, you want IVs to be unpredictable; if you can predict an IV &lt;i&gt;and&lt;/i&gt; you control some of the plaintext, you can in some cases make predictions about secret data that follows your controlled plaintext (this is an &amp;quot;adaptive chosen plaintext&amp;quot; attack).&lt;p&gt;This doesn&amp;#x27;t really come up in 7z&amp;#x27;s usage model; you&amp;#x27;re supposing someone integrates 7z with their own application, which, on-demand, encrypts attacker-controlled data with a secret suffix and puts it somewhere the same attacker can see the resulting ciphertext. Don&amp;#x27;t do this. In fact, if you&amp;#x27;re using ZIP archives in your application, don&amp;#x27;t use ZIP&amp;#x27;s AES at all; encrypt yourself with a modern mode. ZIP AES isn&amp;#x27;t meaningfully authenticated.&lt;p&gt;Having said all that: for the normal usage of an encrypted ZIP, this doesn&amp;#x27;t really matter at all.&lt;p&gt;It&amp;#x27;s a good finding, though! Cheers to anyone who takes the time to look at the underlying code for any popular cryptography. I hope they keep it up.&lt;p&gt;A more important PSA: unless you&amp;#x27;re absolutely sure otherwise, you should always assume any ZIP program you&amp;#x27;re using doesn&amp;#x27;t actually encrypt password-protected ZIPs. It&amp;#x27;s just as likely that it&amp;#x27;s using the old, broken PKWARE cipher, which is dispiritingly common due to backwards-compat concerns. It would be nice if there was a mainstream, built-in way to password-protect a file that you could share with someone else (or just stick on a thumb drive), but ZIP encryption isn&amp;#x27;t it.&lt;p&gt;Pentesters sometimes go out of their way to use 7z because it actually does encrypt with a real cipher. And, I guess for what we&amp;#x27;re doing with it, 7z is fine. But it&amp;#x27;s sad that it&amp;#x27;s the best common denominator we have.</text></item></parent_chain><comment><author>anyfoo</author><text>Coupled with the very simplistic and predictable passwords often encountered in passworded (avoiding the word &amp;quot;encrypted&amp;quot;) ZIPs, I often have the impression that the intention is more to add an explicit human step to open the ZIP. So, making it (less) accessible to crawlers, or give a non-malicious recipient a moment to think whether they want&amp;#x2F;need&amp;#x2F;should extract this.&lt;p&gt;Often the password comes in the same mail or website, after all.</text></comment>