ZipCrypto: the original ZIP cipher

The original ZIP cipher

ZipCrypto is the name commonly given to the traditional encryption method that PKWARE built into the ZIP format in the late 1980s to early 1990s. For many years it was the only way to password-protect a ZIP, and because it is part of the original specification, essentially every archive tool can read it. That universal support is the main reason it is still seen today, long after its weaknesses became well understood.

You will see it under several names. The original PKWARE specification calls it traditional encryption; some tools label it ZipCrypto, others simply Standard or Zip 2.0. They all refer to the same cipher described here, so the label a particular program shows does not change how the protection behaves or how it is recovered.

How it works

ZipCrypto is a stream cipher. It keeps a small internal state of three 32-bit values, initialized from your password and then continuously updated using the same CRC-32 function the ZIP format already uses for checksums. For each byte of data, the state produces one pseudo-random byte, which is combined with the plaintext to produce the ciphertext. Decryption runs the identical process in reverse.

Before an entry's actual data, ZipCrypto prepends a 12-byte encryption header. These twelve bytes are encrypted like the rest of the entry and serve to further randomize the cipher state, so that two entries protected with the same password do not produce identical keystreams.

The quick password check

The encryption header also provides a fast way to reject a wrong password. When the header is decrypted, its final byte, and in some versions the final two bytes, is compared against a value the tool already knows. Normally that value is the most significant byte of the entry's CRC-32 checksum. When the archive was written in a streaming fashion and stores its checksum in a trailing data descriptor, the high byte of the file's DOS modification time is used instead.

This check is only a filter. A single byte matches by chance roughly once in 256 tries, so over a long search many wrong passwords pass it too. A reliable tool confirms a surviving candidate by fully decrypting the entry and verifying its CRC-32. ZipRecover does this for entries of at least 4 bytes that are stored or compressed with Deflate, which covers nearly every archive; when only a shorter entry can be tested, the result says the password passed only a quick check. It cannot confirm an entry compressed with another method, such as BZip2, LZMA, or Deflate64 (options in tools like 7-Zip): for those it only compares the decrypted length with the size recorded in the archive, which a compressed file almost never matches. So when every encrypted file uses such a method, a search usually ends without a match even when the right password is tried. The full sequence is described in how it works.

Fast to test, weak by design

Because the key setup is just a short pass over the password and the 12-byte header, with no deliberate slowdown, ZipCrypto passwords can be tested extremely quickly. A modern machine can try very large numbers of candidates per second. That speed is convenient during recovery, but it is also exactly what makes the scheme weak: no cost is imposed on anyone who wants to guess.

The deeper problem is structural. In 1994, Eli Biham and Paul Kocher published a known-plaintext attack on the PKZIP stream cipher. If you know at least 12 bytes of an encrypted entry as it is stored, that is after any compression, with 8 of them in a row, the attack can recover the cipher's internal state directly, without trying passwords at all. Such known bytes exist when an archive holds an uncompressed file with a predictable header, or a file whose copy also exists in the clear elsewhere and can be compressed again the same way. Once the internal state is recovered, every entry encrypted with the same password can be decrypted.

A comparison, and a recommendation

Property by property, the full comparison of ZipCrypto and WinZip AES lives on the encrypted ZIP files overview, and how secure password-protected ZIP files are explains what that gap means in practice.

For any new archive, prefer WinZip AES, which replaces the stream cipher with AES, adds slow PBKDF2 key derivation, and authenticates each entry with an HMAC. If you are only trying to open an archive you already have, ZipCrypto's speed works in your favor, and ZipRecover detects the scheme automatically when you load the file.