What is the encryption that is used by FastZip?

[zivsha]

Can anyone tell me what is the default encryption used when setting a password for a FastZip?
I'm using v1.1.0.
Is there a way to specify which encryption to use when using FastZip?
Or at least which AES to use?

[Numpsy]

The default would be ZipCrypto.

I was working on adding a direct means of setting the encryption method to use in #380, but that is still a work in progress, and there is no direct way to configure the algorithm in the current version.

[Numpsy]

(I say 'direct' because reading this has just given me the idea that you might be able to do it by setting the EntryFactory property of the FastZip instance to a factory that enables AES on file entries, i'll have a think about at that)

[Numpsy]

hmm, in the short term you could try defining something like

class AesEntryFactory : IEntryFactory
{
    readonly ZipEntryFactory factory = new ZipEntryFactory();

    INameTransform IEntryFactory.NameTransform
    {
        get => factory.NameTransform;
        set => factory.NameTransform = value; 
    }

    ZipEntry IEntryFactory.MakeDirectoryEntry(string directoryName) => factory.MakeDirectoryEntry(directoryName);

    ZipEntry IEntryFactory.MakeDirectoryEntry(string directoryName, bool useFileSystem) => factory.MakeDirectoryEntry(directoryName, useFileSystem);

    ZipEntry IEntryFactory.MakeFileEntry(string fileName)
    {
        var entry = factory.MakeFileEntry(fileName);
        entry.AESKeySize = 256;

        return entry;
    }

    ZipEntry IEntryFactory.MakeFileEntry(string fileName, bool useFileSystem)
    {
        var entry = factory.MakeFileEntry(fileName, useFileSystem);
        entry.AESKeySize = 256;

        return entry;
    }

    ZipEntry IEntryFactory.MakeFileEntry(string fileName, string entryName, bool useFileSystem)
    {
        var entry = factory.MakeFileEntry(fileName, entryName, useFileSystem);
        entry.AESKeySize = 256;

        return entry;
    }
}

and then pointing FastZip.EntryFactory at that (to set the encryption to AES 256, set to 128 by setting AESKeySize to 128 instead).
This might be taking advantage of how things are implemented rather than an intentional thing though.

[zivsha]

Isn't it enough to just set the AESKeySize for each ZipEntry when the FastZip is processing folders and files during the CreateZip function?

[Numpsy]

yes, that's what the change in #380 does, I was just thinking about whether it could be done when using the 1.1.0 release, without any library side changes.

[zivsha]

ohh cool, thanks a lot!

[zivsha]

@Numpsy is there a way to avoid empty files? When I use AES256 and a folder I'm collecting has a file of size 0, I get an error when unzipping that file.
Should my code be responsible for that or the library?

For the moment if I'm using your code, simply adding the following does the work:

if(entry.Size == 0) return null;

[Numpsy]

There have been bugs with 0 byte files in the past, but I can't remember off hand if there are any outstanding.

Is that unzipping with SharpZipLib, or some other tool?

[Numpsy]

To answer my own question there, it does seem to be hitting a ZipOutputStream bug here - ref #460

I'm not sure offhand about skipping 0 byte files in fast zip - it has some filtering features, not sure about size though

[zivsha]

If we're on the subject, is it correct to mark directory entries with AESKeySize > 0?
If it is, then it is also impossible to unzip such directories which contain only other directories (no files), I'm not sure if your PR fixes it or not, just letting you know.
If it isn't, then I would expect the API to prevent me from making this mistake

[Numpsy]

I don't think it would make sense to do that, but I haven't really considered that case - i'll have a look at it when I get a chance.

[Numpsy]

I've done some tests with ZipOutputStream, and it does hit #460 if I give it a dir entry with an explicitly set size of 0 and enable AES encryption.
If I don't specify the size explicitly then the archive seems to be accepted by 7-Zip, but i'm not convinced that it's actually doing the correct thing.

@piksel Is it really appropriate to write the crypto bits to the output stream at

SharpZipLib/src/ICSharpCode.SharpZipLib/Zip/ZipOutputStream.cs

Line 438 in f36ca37

if (entry.IsCrypted)

When adding a directory entry?

I'd have to read the spec to see if it's technically correct, though 7-zip is fine with reading such entries (it doesn't appear to actually encrypt folders itself though).
Just sounds a little wrong to me to set the compressed size of directory entries to none-0 values, and if you don't explicitly set the size of the entry to zero we do appear to create a descriptor for the entry, which doesn't sound like something you'd want for directory entries?

If it isn't, then I would expect the API to prevent me from making this mistake

Section 4.3.8 of the AppNote says

Zero-byte files, directories, and other file types that contain no content MUST NOT include file data.

So perhaps ZipOutputStream should actually prevent you from writing data to a directory entry?

/Wonders if there is scope here for ZipOutputStream.PutNextEntry to special case directory entries, and just write the basic entry data and then skip over the encryption/zip64/descriptor pieces? (It could possibly even close the entry straight away, such that it isn't possible to try to write data to it?)

[zivsha]

In my trials to use AES256 with FastZip, I marked all files and folder entries with AESKeySize=256. When a folder had no files directly in it, but did have a folder (with files) in it, that folder could not be extracted. However the inner folder could be extracted. 7zip had the same issue.

[Numpsy]

Do you have the CreateEmptyDirectories option enabled on FastZip? That would effect whether the empty folder entries are added to the zip at all.

is it correct to mark directory entries with AESKeySize > 0

I'd suggest not doing that at this point because of the bug I mentioned (encrypting the directory entries in the zip shouldn't reall ydo anything, as they have no content to encrypt anyway)

[piksel]

@zivsha The AES encryption spec says that empty files and folders CAN be encrypted (which would only mean that the encryption overhead is added, no actual data in the entry), but only zero-byte files SHOULD be encrypted.

@Numpsy If encryption for the entry is enabled, then I guess so, but actually writing data to that entry should throw.

I am working on an archive inspector to aid in these types of issues:

[Numpsy]

@zivsha The extensions to FastZip to give it built in support for creating AES encrypted zips are merged now and so should be in the next release. (the documentation\wiki could still do with some new examples for that though)