Security

[Socrates]

Good day,

I just stumbled across this story about the use of brute force techniques to crack passwords.

What hash algorithm do the encrypted forms of zip, 7z, and Rar use? Knowing this may make helps users decide which format is most secure.

I gather, too, that you intentionally slow down the unencryption of PAE2 files to avoid brute force attacks. Correct?

Having some of this info can guide future decisions about which file types to use for delicate data.

[spwolf]

yes, both pae and pae2 are much slower to brute-force due to design… i know sometimes people complain having to wait for whole archive to be decrypted before “wrong password” is shown but it works well in this case.

Both 7zip and ZIP AES encryption use sha256 hashes. Together with proper length not dictionary based passwords, it is still extremely hard/slow to brute force.

Of course, lets put this straight - article talks about linkedin using sha1 but of course as article mentions, this is completely unusable against real world online services where it is not possible to guess password more than few times, let alone 100 billion times per second.

[Socrates]

PAE2 also use a sha256 hash?

[spwolf]

pae/pae2 require full decryption of the file first, so basically they use aes 256bit. they can not quickly check hash to see if guessed password is correct.