#1095269 unar can't extract encrypted zip files created with 7z -mem=AES128

Package:
unar
Source:
unar
Description:
Unarchiver for a variety of file formats
Submitter:
ZenWalker
Date:
2025-02-07 16:03:02 UTC
Severity:
normal
Tags:
#1095269#5
Date:
2025-02-06 08:21:02 UTC
From:
To:
unar works with rar files with password, but it doesnt work with zip files with
password

#1095269#10
Date:
2025-02-06 13:12:27 UTC
From:
To:
ZenWalker wrote:
is not in testing but reportbug says you're using testing.  Did you
install the package manually?

$ echo bar > bar
$ echo baz > baz
$ zip -e foo bar baz
Enter password:
Verify password:
  adding: bar (stored 0%)
  adding: baz (stored 0%)
$ mkdir test && cd test
$ unar ../foo.zip
../foo.zip: Zip
  bar  (4 B)... This archive requires a password to unpack.
Password (will not be shown):
OK.
  baz  (4 B)... OK.
Successfully extracted to "foo".
$ cat foo/bar foo/baz
bar
baz

That's on unstable/amd64 with unar/1.10.8+ds1-7.

#1095269#17
Date:
2025-02-06 14:33:00 UTC
From:
To:
Hi, thanks for your quick reply!

I am in testing, and I installed the sid version to confirm if the bug
is there too.

I follow your steps and I confirm it works as expected.

You can see here the reproducible steps (using the password 1234):

$ echo bar > bar
$ echo baz > baz
$ 7z a -mem=AES128 -tzip -p1234 foo.zip bar baz

7-Zip 24.09 (x64) : Copyright (c) 1999-2024 Igor Pavlov : 2024-11-29
 64-bit locale=C.UTF-8 Threads:4 OPEN_MAX:1024

Scanning the drive:
2 files, 8 bytes (1 KiB)

Creating archive: foo.zip

Add new data to archive: 2 files, 8 bytes (1 KiB)


Files read from disk: 2
Archive size: 350 bytes (1 KiB)
Everything is Ok

$ mkdir test && cd test
$ unar ../foo.zip

../foo.zip: Zip
  bar  (4 B)... This archive requires a password to unpack.
Password (will not be shown):
Failed! (Missing or wrong password)
  baz  (4 B)... Failed! (Missing or wrong password)
Extraction to directory "foo" failed (2 files failed.)

as you can see, the problem is with .zip files created with 7z and
-mem=AES128

#1095269#22
Date:
2025-02-07 13:03:41 UTC
From:
To:
ZenWalker wrote:

I see, but there's no reason to do that as it just causes confusion.
If you encounter a bug in a supported suite just file it.  The only
thing that's good to do is check if it isn't already reported.  It's
the maintainer's job to figure out if it is fixed or not in the higher
version.
unar successfully extracts an encrypted archive without it (it seems
7z is using AES-256 by default which is stronger) so I'm lowering the
severity.

BTW, unzip also cannot handle it:

$ unzip ../foo.zip
Archive:  ../foo.zip
   skipping: bar                     need PK compat. v5.1 (can do v4.6)
   skipping: baz                     need PK compat. v5.1 (can do v4.6)

I don't have a clue what PK means.

#1095269#33
Date:
2025-02-07 15:45:33 UTC
From:
To:
7z documentation:

https://documentation.help/7-Zip/method.htm

seems the default is ZipCrypto

unar works if the file is compressed with:

$ 7z a -mem=ZipCrypto -tzip -p1234 foo.zip bar baz
$ 7z a -tzip -p1234 foo.zip bar baz

and unar fails if the file is compressed with:

$ 7z a -mem=AES128 -tzip -p1234 foo.zip bar baz
$ 7z a -mem=AES192 -tzip -p1234 foo.zip bar baz
$ 7z a -mem=AES256 -tzip -p1234 foo.zip bar baz

#1095269#38
Date:
2025-02-07 16:01:20 UTC
From:
To:
ZenWalker wrote:

Thanks; that's not available in the Debian package, I think.  It's
also impossible for me to read or understand.  There's no mem option
AFAICS with listed allowed parameters.  But nevermind.

So the AES-256 fanfares at their website are slightly misleading.

Yes, I tried the second invocation.

OK, thanks for the info.  I'll look into this when I find some time.
Would appreciate if you report it upstream as well.