2

I am able to create a zip file and add files using the zip4j library but the problem is the password is set only for the files inside the zip, so I am able to open the zip and see the file list, which I don't want. I want to set a password for the zip archive.

Any suggestions?

eis
  • 51,991
  • 13
  • 150
  • 199
HARISH KUMAR B
  • 23
  • 4
  • Would you share the code to provide the minimal reproducible example https://stackoverflow.com/help/minimal-reproducible-example? – HoRn Dec 01 '21 at 09:22
  • "the problem is the password is set only for the files inside the zip, so I am unable to open the zip and see the file list" - do you mean you are *able* to? – eis Dec 02 '21 at 06:58
  • @eis yes i am able to open the zip and see files list – HARISH KUMAR B Dec 02 '21 at 10:30

2 Answers2

2

It's not the fault of the library - Zip format does not support this:

The Zip file format is such that the files added to a Zip file are encrypted, whereas the Zip file itself is not. Therefore, any user can open a Zip file and see the list of files even when those files are encrypted. However, the user will not be able to extract or view the encrypted files unless he or she enters the correct password to decrypt them.

To hide the names of the files in your encrypted Zip file, you can double zip them.

So you can make a .zip from your .zip for this. It doesn't seem to be possible in any other way.

Edit: @oleg.cherednik pointed out that current versions of the zip specification do support this, but the support doesn't seem to be implemented in libraries. So in practice you would need to double-zip your files.

eis
  • 51,991
  • 13
  • 150
  • 199
  • Actually, zip format supports secure entires - https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT - 7.3 Single Password - Central Directory Encryption – Oleg Cherednik Jan 09 '22 at 23:08
  • @oleg.cherednik ah, seems so. by looking at [app note archives](https://support.pkware.com/home/pkzip/developer-tools/appnote/application-note-archives), seems that feature was added in version 6.2 of the specification. Also [wikipedia seems to support this](https://en.wikipedia.org/wiki/ZIP_(file_format)#Encryption). – eis Jan 10 '22 at 08:56
0

This is APPNOTE.TXT - .ZIP File Format Specification. You can find there 7.3 Single Password - Central Directory Encryption. The problem is this feature is protected and looks like it is not in public access. You cannot find any open-source tool that supports this. (believe me, I have tried it).

Only one application that supports this is PKWARE's SecureZIP for Windows. You can find a free version of this tool as well.

All you can do in the java application is zip files twice.

Oleg Cherednik
  • 17,377
  • 4
  • 21
  • 35