Add Directory with Password and Encryption

Jan 31, 2011 at 9:50 PM

I'm trying to compress an entire directory using the AddDirectory method, however it will not apply a password to the file.  Is there a way to do this or will I have to manually iterate through the directory and add each item individually?

Coordinator
Feb 1, 2011 at 5:29 AM

Set the Password property on the ZipFile before calling ZipFile.AddDirectory().

 

Feb 1, 2011 at 1:52 PM

I do set the password property prior to calling the AddDirectory method but I am still able to extract the resulting archive without entering a password.

Coordinator
Feb 2, 2011 at 2:42 PM

That would be a surprise. can you show me your code?  Specifically, everything within the using() clause for the ZipFile.

Feb 2, 2011 at 3:01 PM

Using zip As New ZipFile            
zip.Password = "123456"
zip.Encryption = EncryptionAlgorithm.WinZipAes256            
zip.AddDirectory("C:\Temp")            
zip.Save("C:\Temp\Test.zip")        
End Using

It's just a basic test.  The directory and subdirectories compress correctly, but I can extract them using WinRar without entering a password.

 

Coordinator
Feb 2, 2011 at 7:19 PM

Just tested your code here. I don't see the results you report. I don't have WinRar, but I used Windows itself to open the zip file.

When I open the file I can see the entries.  This is expected and documented behavior. (See the information on the ZipFile.Password property)  When I try to extract any entry, Windows tells me it cannot extract.  (This is because Windows doesn't handle AES encryption in zip files).

If I open the zip in the DotNetZip tool ("\Program Files (x86)\Dino Chiesa\DotNetZip Tools v1.9\DotNetZip-WinFormsTool.exe") , once again I can see all the entries. When I try to extract the entries, the tool prompts me for the password, as expected.  It cannot extract without the password.

What version of the DotNetZip library are you using?  Are you certain that you are extracting the files, and not just viewing the entry names and metadata?

Feb 2, 2011 at 7:34 PM

I can fully extract and use/open/rename/delete/etc the files contained within the zip file without entering a password using both WinRar and WinZip. 

I'm using DotNetZip Version 1.9.

Feb 2, 2011 at 7:35 PM

Even if I do not attempt to encrypt the archive, I am able to extract the directory and files contained within and use them without a password.

Coordinator
Feb 2, 2011 at 8:00 PM

I think there's an assumption you're making that isn't valid.

Is it possible that the zipfile you are opening and extracting is NOT what you think it is?  Is it possible you are opening and extracting a zipfile that was produced by an earlier version of your app that did not use encryption? or a zipfile that was produced by some other tool?

Is it a possibility is that you are holding open the resulting zipfile, and when you run your app, it is silently throwing and suppressing an exception, with the result that \temp\test.zip is not getting updated?

One thing I didn't point out in your code: you are saving to the file c:\temp\test.zip , and also implicitly including that c:\temp\test.zip into the final zip file. This seems like not something you want to do.  If you run the app multiple times in succession, the size of the final zip file grows and grows. 

A way to test this further on your end would be to simplify your test app one more time - instead of using AddDirectory(), call AddFile().  Create a zip file with a single entry in it. 

Use a new name for the final zip file (not \temp\test.zip) .  then see if you can open that new file and extract the single entry.

Somewhere along the chain there is an assumption that's been made, that is not valid.

I have a test suite with hundreds of tests; some of them specifically focus on creating zip files with AES encryption and then verifying that it is impossible to extract entries from those zip files without supplying a password.  So I'm pretty certain that AES encryption in DotNetZip works. 

 

Feb 2, 2011 at 8:50 PM

Thanks for trying here but no it is not possible that I am opening and extracting a zip file produced by an earlier version or by a different tool.  I am also not holding open the zip file when I run my app and suppressing an exception.  

The code that I listed above is the exact code I'm running to test the password functionality.

Even if I change the location of the resulting zip file the password functionality does not work.   

This is the exact test code I am running.
Private Sub Button3_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button3.Click        
     Using zip As New ZipFile            
          zip.Password = "123456"            
          zip.AddDirectory("C:\Temp")            
          zip.Save("C:\Test\Test.zip")        
     End Using    
End Sub

The password functionality will work if I add individual files; however, it does not work when using the AddDirectory method.  Which will be required in the application I am going to build.

I can't think of anything else that would cause a problem.  The VB.Net application consists of a single form built solely to test DotNetZip.  The only additional reference is to the Ionic.Zip dll.

 

Coordinator
Feb 2, 2011 at 9:22 PM

ok, here's another idea:  Are you certain that WinRar supports reading of AES-encrypted zip files?  I am not so familiar with the feature set of that tool.  Is it possible that WinRar is ignoring the "strong encryption" bit in the zip entry, when it extracts?  Have you compared the extracted output to the original file, for each entry?   Have you verified that the output files have the same checksum as the input?

And another suggestion: After creating the zipfile and saving it, and AFTER exiting from the Using clause, open a new Using clause on the same filesystem file.  Iterate through the entries and print out or display the Encryption property on each ZipEntry.  what does it say?

You can also try reading and displaying the ZipFile.Info property.  This will return a string, containing diagnostic information about each entry in the zipfile.  Use this only when reading a new zipfile that had been previously saved.

Also:  if you open the zipfile in Windows Explorer, what happens?  Can you extract? What message do you get?

And: have you tried WinZip to perform the extraction?  V9 and above supports AES encryption. You can download a trial version for free.  It's fully functional but it gives you nag screens.

Finally, have you tried the DotNetZip library itself to extract these entries?  What if you try extracting in a VB app that you wrote?  Does it work?  If the entries are password protected, you will get exceptions indicating that fact.

 

 

 

Feb 2, 2011 at 9:22 PM

Cheeso,  I have found the issue.

I created several directories and blank text files to simply test the .AddDirectory functionality and whether or not it persevered the directory structure.  

As it turns out, empty text files will extract without requiring a password.  If the Zip contains a file with an actual file size it will prompt for a password before extracting.


Thanks for looking into this for me.  The library is great and does exactly what I need it to so I will definitely be donating.

Coordinator
Feb 2, 2011 at 9:31 PM

Terrific, glad you tracked it down.  Yes - I should have thought of that.  DotNetZip does not encrypt a zero-length file entry, so anyone can extract it.

In a zipfile, since the metadata itself is unencrypted, it is easy to see that an encrypted entry is zero bytes in length, even if you don't have the password.  Therefore to encrypt and password-protect such an entry is sort of pointless.  I decided that when that happened, I'd eliminate the encryption completely for that entry.   I'm still not sure that was the right design decision.

 

 

 

Feb 12, 2011 at 1:08 PM
Edited Feb 12, 2011 at 1:29 PM

hi,

i am facing a problem in adding password

below is the code

Using ZipFile1 As New Ionic.Zip.ZipFile
            ZipFile1.Encryption = Ionic.Zip.EncryptionAlgorithm.WinZipAes256

            ZipFile1.Strategy = Ionic.Zlib.CompressionStrategy.Default
            ZipFile1.AddFile("L:\temp\abc.xls", "")
            'ZipFile1.AddFile("c:\Desktop\2005_Annual_Report.pdf", "")
            'ZipFile1.AddFile("ReadMe.txt")
            ZipFile1.Password = "sdewfjjedc"
            ZipFile1.Save("zippedfile")
        End Using

the error is generated in the last line..Save

it says Supply a password to use AES encryption

Feb 12, 2011 at 1:39 PM
Edited Feb 12, 2011 at 1:42 PM

The problem got solved. !!!!!

i need to put the zipfile1.password line immediately below the zipfile1.encryption before adding files to the zip

however the zip file getting created is without .zip extension

apologies...just adding .zip to the file and rebuilding the application solved it.

wanted to delete this post..cant find a button :D