CyberStack

Guides / A wrap, not a vault

Password-protected zip

A password on a zip is a convenience wrap for handing a file across. ZipCrypto is weak. AES-256 from 7-Zip is the command. The password does not ride with the file.

Password zip: AES wrap, passphrase out of bandWrap the file as an AES zip. Send the passphrase on a different channel. A zip password is a handover wrap, not a vault.WRAPOTHERFILEPlain filenames still visibleAESAES zip7-Zip, not ZipCryptoKEYPassphraseother channelA ZIP PASSWORD IS A WRAP, NOT A VAULTAES-256 from 7-Zip. ZipCrypto is the weak command already on the machine.The passphrase travels on a different channel from the file.

A password-protected zip is a file you can email or drop, wrapped so a casual opener needs a passphrase. It is not disk encryption and it is not a vault. The names of the files inside a zip stay visible. Send the passphrase on a different channel from the file.

First principles

Two different ciphers get called a zip password. Info-ZIP zip -e uses ZipCrypto. That cipher is old, and a known file inside the archive is enough to attack the rest. Do not use it for anything that matters. 7-Zip can write a zip with AES-256. That is the command below. The other person needs a tool that speaks AES zip: 7-Zip, The Unarchiver, or Keka. Finder and Explorer Extract often only speak ZipCrypto, which is why the weak command still exists.

macOS and Linux

Install 7-Zip if it is not already there. The binary is 7zz on Homebrew sevenzip and some Linux packages, or 7z on Debian and Ubuntu's 7zip package. Same flags. -p with nothing after it prompts. Do not write the password on the line. It lands in shell history and in the process list.

7zz a -tzip -mem=AES256 -p handover.zip ./folder

If the shell says command not found, run the same arguments with 7z. Hand it a folder and it recurses. To wrap one file, name the file instead of ./folder.

Windows

PowerShell Compress-Archive cannot set a password. Explorer Send to compressed folder cannot either, from a command. The command is 7-Zip:

& "$env:ProgramFiles\7-Zip\7z.exe" a -tzip -mem=AES256 -p handover.zip .\folder

It prompts. Do not put the password after -p.

The zip that is already installed

macOS and most Linux boxes already have Info-ZIP. It prompts, and it uses ZipCrypto:

zip -er handover.zip ./folder

Fine for a throwaway bundle that is not a secret. Not fine for customer data, credentials, or anything you would not put in chat. If the other side can only open a zip with Finder or Explorer, you are choosing ZipCrypto, or you send them 7-Zip. Say which you chose.

Open it

7zz x handover.zip

On Windows, 7z.exe x handover.zip from the same Program Files path. The tool prompts again.

House rules

  • Password on a different channel from the zip. Not the same email. Not the ticket the file is attached to.
  • Never -pYourPassword and never zip -P. History and the process list keep it.
  • Filenames inside the zip are not secret. Rename first if the names themselves matter, or use a 7z archive with header encryption instead of zip.
  • This does not replace FileVault, BitLocker, or LUKS. Those protect a disk that left the building. This wraps one handover.
  • If the zip held a secret and the password travelled with it, treat the contents as burned. Rotate whatever was inside.

Informed by 7-Zip.