I am looking at encrypted zip files (using PKzip format) and I don't understand how the encryption scheme is encoded in the binary format. In my research, I found this paper outlining the various encryption schemes used in PKzip formatted files. I found that the encrypted files I've been looking at match the magic number format 50 4b 03 04 outlined in the article. According to the paper, the encryption scheme type used can be determined from the 2-bytes after the file name in the file (17 00 for "Strong Encryption" and 01 99 for "WinZip AES encryption". It does not state such a signature for "Traditional PKWare Encryption".
I created an encrypted zip file using Keka to examine the contents and see what kind of encryption was used. Neither of the magic numbers mentioned in the article appeared after the file name, instead I found the bytes 54 73. In fact, upon adding some more bytes to the plaintext file that I encrypted, I noticed that after encrypting, these bytes changed just a little bit, suggesting that they are not in fact an indicator of the encryption scheme used. I've looked at the output of zipdetails to try and see if there are any more details on the encryption scheme used, but the output simply states that the file is encrypted. Are there any useful tools to analyze and determine the encryption scheme used in an encrypted PKzip file?
