http://coldfusion.com logo
Join Slack
Powered by
I have a task where I need to encrypt some files o...
# cfml-general
p
I have a task where I need to encrypt some files on the server and make them available for download. The receiving person would then have an encrypted zip file. They are on Windows. Any ideas on what tool can be used to unencrypt the zip file on a windows machine?
s
If you use cfzip / cfzipparam to encrypt it and password protect it https://helpx.adobe.com/coldfusion/cfml-reference/coldfusion-tags/tags-u-z/cfzipparam.html then they should just need the password and some zip utility
(at least that is my understanding... I have never actually tried it)
q
Just remember, ZIP files are /password protected/ and not encrypted. It's trivial to extract files without knowing the password. There are many other archiving tools that are better. RAR, 7zip, etc. can actually encrypt files.
s
Quetwo - when I read the docs for the encryptionAlgorithm attribute of cfzip, it says "The encryption algorithm to use for compression...." are you saying that does not actually encrypt the file?
q
I don't believe so. Unless they are making them incompatible with pkzip/winzip which is the standard-barer of the ZIP file. Those programs only did password protecting of the headers, which was easy to retrieve.
s
I'm not claiming any particular understanding of what is happening under the hood, but the docs seem to imply otherwise (at least the way I am reading it). It looks like it would result in the files that are being compressed to also be encrypted with the specified algorithm. Then you would need the password to extract the files.
So either quetwo is incorrect, or the docs need to be updated to clearly explain what is being encrypted.
@priyank_adobe are you able to elaborate/add clarity to how the encryptionAlgorithm is used in cfzip?
from winzip documentation, it look slike they support encryption. https://kb.winzip.com/help/help_encryption.htm
so I am thinking perhaps you are basing your assumption on some previous version of winzip that did not support it?
q
Note that the Zip file format extension used by WinZip to store AES-encrypted files is supported by WinZip 9.0 or later and is supported by some other Zip file utilities. Because the technical specification for WinZip's AES format extension is available on the WinZip web site, we anticipate that other Zip file utilities will add support for this format extension.
So, not supported by the standard, and most other ZIP tools. "Standard" encryption is supported, but only protects the file headers
s
you are quoting an article from 2009
the cf support for cfzip encryption was added in CF 11 (in 2014). I would refer you to the page I linked above (https://kb.winzip.com/help/help_encryption.htm) for more current documentation of winzip encryption capabilities
"standard" encryption seems weak, but I think you would be in decent shape if you set encryptionAlgorithm = "AES-256"
seems like it's not bullet proof but would certainly prevent the casual person from being able to get into the contents
p
I will check and confirm the encryptionAlgorithm is used in cfzip, please give me a day to get back to you.
👍🏻 1
s
I appreciate it.
p
image.png
👍🏻 1
s
I am guessing (Based on the fact that the attribute options correlate perfectly) that most likely this tag attribute implements the AES encryption options that winzip offers.
I would reccomend reading the "Limitations to be aware of" and "Notes on encryption safety" sections of that article I linked earlier
so if we just put a password cfzip uses the strongest option by default. that is good to know
p
Thank you all!
2 Views
Open in Slack
PreviousNext
Powered by