How secure is ZIP encryption in macOS?

[DominikHoffmann]

In Terminal I can encrypt files with

zip -re encrypted-filename.zip filename-to-be-encrypted

How secure is that encryption? The man file for zip does not go into the encryption algorithm(s) used. I imagine that the ZIP specification allows for modern encryption algorithms to be used. However, how up-to-date is the command-line zip command on that score?

 

[DominikHoffmann]

Follow-up: zip -v produces this output:

zip -v
Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license.
This is Zip 3.0 (July 5th 2008), by Info-ZIP.
Currently maintained by E. Gordon.  Please send bug reports to
the authors using the web page at www.info-zip.org; see README for details.

Latest sources and executables are at ftp://ftp.info-zip.org/pub/infozip,
as of above date; see http://www.info-zip.org/ for other sites.

Compiled with gcc Apple LLVM 14.0.3 (clang-1403.0.22.11) [+internal-os] for Unix (Mac OS X) on Jun 23 2023.

Zip special compilation options:
    USE_EF_UT_TIME       (store Universal Time)
    SYMLINK_SUPPORT      (symbolic links supported)
    LARGE_FILE_SUPPORT   (can read and write large files on file system)
    ZIP64_SUPPORT        (use Zip64 to store large files in archives)
    STORE_UNIX_UIDs_GIDs (store UID/GID sizes/values using new extra field)
    UIDGID_16BIT         (old Unix 16-bit UID/GID extra field also used)
    [encryption, version 2.91 of 05 Jan 2007] (modified for Zip 3)

Encryption notice:
    The encryption code of this program is not copyrighted and is
    put in the public domain.  It was originally written in Europe
    and, to the best of our knowledge, can be freely distributed
    in both source and object forms from any country, including
    the USA under License Exception TSU of the U.S. Export
    Administration Regulations (section 740.13(e)) of 6 June 2002.

Zip environment options:
             ZIP:  [none]
          ZIPOPT:  [none]

While this provides some extra information, it still does not specify the encryption algorithm used by default, much less available options.

 

[bogdanw]

As far as I know, it uses Zip 2.0 (Legacy)/ ZipCrypto encryption, considered not secure
https://forums.macrumors.com/threads/compressing-files-with-a-password.2378263/post-31928423

 

[chrfr]

Follow-up: zip -v produces this output:

zip -v
Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license.
This is Zip 3.0 (July 5th 2008), by Info-ZIP.
Currently maintained by E. Gordon.  Please send bug reports to
the authors using the web page at www.info-zip.org; see README for details.

Latest sources and executables are at ftp://ftp.info-zip.org/pub/infozip,
as of above date; see http://www.info-zip.org/ for other sites.

Compiled with gcc Apple LLVM 14.0.3 (clang-1403.0.22.11) [+internal-os] for Unix (Mac OS X) on Jun 23 2023.

Zip special compilation options:
    USE_EF_UT_TIME       (store Universal Time)
    SYMLINK_SUPPORT      (symbolic links supported)
    LARGE_FILE_SUPPORT   (can read and write large files on file system)
    ZIP64_SUPPORT        (use Zip64 to store large files in archives)
    STORE_UNIX_UIDs_GIDs (store UID/GID sizes/values using new extra field)
    UIDGID_16BIT         (old Unix 16-bit UID/GID extra field also used)
    [encryption, version 2.91 of 05 Jan 2007] (modified for Zip 3)

Encryption notice:
    The encryption code of this program is not copyrighted and is
    put in the public domain.  It was originally written in Europe
    and, to the best of our knowledge, can be freely distributed
    in both source and object forms from any country, including
    the USA under License Exception TSU of the U.S. Export
    Administration Regulations (section 740.13(e)) of 6 June 2002.

Zip environment options:
             ZIP:  [none]
          ZIPOPT:  [none]

While this provides some extra information, it still does not specify the encryption algorithm used by default, much less available options.

As above, zip encryption is insecure. Do not rely on it for secure documents.