WinZip AES encryption, explained in detail

AES comes to the ZIP format

Traditional ZIP encryption was never strong, so WinZip introduced an AES-based scheme that most modern archive tools now support. It replaces the old cipher, ZipCrypto, with the Advanced Encryption Standard, adds a proper key derivation function, and attaches a real integrity check to every entry. The result is encryption that stands up to scrutiny, at the deliberate cost of being slow to test.

How it looks inside the ZIP

An AES-encrypted entry does not record its true compression method in the usual place. Instead the method field is set to 99, a marker that means "AES encrypted," and the real compression method is stored elsewhere. The details live in an extra field with header id 0x9901. That field holds a two-character vendor tag, AE, a version number that is either AE-1 or AE-2, a strength byte, and the actual compression method used underneath the encryption.

The strength byte drives the rest of the scheme. A value of 1 means AES-128, 2 means AES-192, and 3 means AES-256. From that single byte a tool knows the key length, the salt length, and how much key material to derive.

Key derivation

Your password is never used directly as a key. WinZip AES runs it through PBKDF2-HMAC-SHA1 with 1000 iterations and a random salt stored with the entry. The salt length depends on the strength: 8 bytes for AES-128, 12 bytes for AES-192, and 16 bytes for AES-256. PBKDF2 stretches the password into a block of key material, which is split into three parts: the AES encryption key, a separate authentication key of the same length, and a 2-byte password verification value.

That 2-byte value is stored in the entry. It lets a tool reject a wrong password almost immediately, without decrypting anything, because the correct password reproduces the same two bytes. It is only a fast filter, not proof, since two different passwords could in principle produce the same pair of bytes. Final confirmation comes from the authentication code.

Encryption and authentication

The file data is encrypted with AES in CTR, or counter, mode. This turns the block cipher into a keystream and lets an entry of any length be encrypted byte for byte. Integrity is handled separately. After encryption, an HMAC-SHA1 is computed over the ciphertext using the authentication key, and the first 10 bytes of that HMAC are stored at the end of the entry. This is an encrypt-then-MAC design: the authentication code covers the encrypted bytes, so a tool can verify that both the password and the data are correct before it ever attempts to decompress.

The two versions differ in one detail. AE-1 keeps the entry's CRC-32 checksum in the header, which allows a second, older integrity check after decryption. AE-2 sets the CRC field to zero and relies entirely on the HMAC. Both use the same cipher and the same key derivation; the difference is only in how integrity is recorded.

Why it is strong, and slow

Two properties make WinZip AES resistant to password guessing. First, AES itself has no practical shortcut, so an attacker cannot recover the key from the ciphertext directly. Second, the 1000 iterations of PBKDF2 are there on purpose. Deriving a key from one candidate password costs a thousand HMAC-SHA1 operations per 20-byte output block (about four thousand for AES-256), so testing passwords is about 375 times slower than under a scheme with no stretching in our single-thread measurement (see how long recovery takes). That cost is trivial for someone who knows their password and types it once, but it makes large-scale guessing expensive.

In practice, an AES-encrypted archive locked with a strong, randomly generated password is effectively not recoverable by guessing, no matter how fast the hardware. Recovery stands a real chance only when the password is short, follows a pattern you remember, or appears in a wordlist you can supply. That limit comes from the scheme itself, and no recovery tool, ours included, gets around it. How ZipRecover uses the verification value and the HMAC together is described in how it works. The overview of encrypted ZIP files places AES alongside the legacy scheme, and ZipCrypto vs AES encryption compared sets the two side by side.