Password protection
The data of ZIP files can be password protected / encrypted by passing a password as the password parameter to stream_zip or async_stream_zip. This encrypts the data with AES-256, adhering to the WinZip AE-2 specification.
import secrets
password = secrets.token_urlsafe(32)
encrypted_zipped_chunks = stream_zip(member_files(), password=password)
You should use a long and random password, for example one generated by the Python secrets module.
While AE-2 is seen as more secure than ZipCrypto, the original mechanism of password protecting ZIP files, fewer clients support AE-2 than ZipCrypto.
More importantly, AE-2 has flaws. These include:
-
Not encrypting metadata, for example member file names, modification times, permissions, and sizes.
-
Not including sufficient mechanisms to alert recipients if data or metadata has been intercepted and changed. This can itself lead to information leakage.
- A higher risk of information leakage when there’s a higher number of member files in the ZIP encrypted with the same password, as stream-zip does. Although AE-2 with AES-256 likely mitigates this enough for all situations but the extremely risk averse that also have an extremely high number of member files.
See “Attacking and Repairing the WinZip Encryption Scheme” by Tadayoshi Kohno and fgrieu’s answer to a question about WinZip’s AE-1 and AE-2 on Crytography Stack Exchange for more information.