DotNetZip WinZipAes256 Using Random Salt?

Question

Forgive me if the answer to this is very obvious.

I need to know if the AES 256 Encryption in DotNetZip (Ionic.Zip.dll) generates a random salt?

e.g. Does EncryptionAlgorithm.WinZipAes256 make use of the internal class WinZipAesCrypto. And specifically the static method WinZipAesCrypto Generate??

  using (ZipFile zip = new ZipFile())
  {
    zip.AddFile("CustomerData.pdf"); 
    zip.Password= "123456!";
    zip.Encryption = EncryptionAlgorithm.WinZipAes256;       
    zip.Save("Customer.zip");
  }

One of the requirements put to me is that a random salt is generated every time we AES encrypt and I need to be 100% sure that this is the case?

Thank you

See http://www.winzip.com/aes_info.htm for additional info. – Stefan Mar 19 '15 at 10:35 — Stefan, Mar 19 '15 at 10:35

score 2 · Answer 1 · answered Mar 19 '15 at 10:35

2

From https://dotnetzip.codeplex.com/SourceControl/latest#Zip/WinZipAes.cs

public static WinZipAesCrypto Generate(string password, int KeyStrengthInBits)
{
    WinZipAesCrypto c = new WinZipAesCrypto(password, KeyStrengthInBits);

    int saltSizeInBytes = c._KeyStrengthInBytes / 2;
    c._Salt = new byte[saltSizeInBytes];
    Random rnd = new Random();
    rnd.NextBytes(c._Salt);
    return c;
}

So, yes, it's (pseudo) random, but not cryptographically strong. If that's a concern, you could always download the source and rewrite the method to use RNGCryptoServiceProvider.

answered Mar 19 '15 at 10:35

spender

117,338
33
229
351

Thanks for the reply, bare with me here I'm new to this. Ok I have seen the code that you posted. But how can I be 100% certain that the method EncryptionAlgorithm.WinZipAes256 makes use of this? – fourbeatcoder Mar 19 '15 at 10:38
...or by taking assurance from the comment in the file WinZipAes that claims: Most uses of the DotNetZip library will not involve direct calls into the WinZipAesCrypto class. Instead, the WinZipAesCrypto class is instantiated and used by the ZipEntry() class when WinZip AES encryption or decryption on an entry is employed. – spender Mar 19 '15 at 10:41
@fourbeatcoder: Also, as a test, you could encrypt the same file twice and perform a binary compare. Although this doesn't tell you anything about the 'salt' generation algorithm, it will guaranty that, provided the result is different, there is some "random" component in the encryption. – Stefan Mar 19 '15 at 10:41
Of course, you can't be 100% sure unless you compile the code yourself and place a breakpoint.... – spender Mar 19 '15 at 10:43
@stefan thank you. I did see that comment regarding indirect calls. I will look into performing a binary compare. And if I'm not successful I will download the code. – fourbeatcoder Mar 19 '15 at 10:47

DotNetZip WinZipAes256 Using Random Salt?

1 Answers1