Re: building compatible zip files "by hand" that are encrypted and compressed

Ed,

> Thank you, that is very helpful information.

You bet.

> Supposing then I accept the vulnerable but universal
> 96-bit encryption, how formidable do you think my two
> tasks are:  1) Encrypting and compressing the files on
> the "upstream" side, before the client sends them, and
> 2) Building the ZIP file from the (already compressed
> and encrypted) files later?

In theory, not too bad.  All the source code you need for the
difficult parts already exists; you just need to glue it together
the right way.  Of course, you're pretty much on your own for
that.

> I can see already that if I compress the file on the
> client before sending it to the server I must also
> transmit the original file size to the server; and if
> I eventually allow the end user to select from a menu
> of encryption methods I must also transmit which
> algorithm was used.  I can add those items to my
> protocol very easily.  I'm wondering what else I might
> need to send to the server so that it can construct a
> valid ZIP file later.

Just look at the zipfile header layouts in unzip.h or unzpriv.h,
or do "unzip -Zv" on an archive and look at the kind of info you
get.  Most of it isn't too relevant (i.e., you could hardcode it),
but you will need to compute the CRC of the uncompressed data.

> Are there any librarys or classes related to info-zip
> that would make the two tasks easier?

Not that we make.  The DynaZip DLLs are based on Info-ZIP code, but
I don't know anything beyond that.

> Any pointers to documentation would be welcome too.

See appnote in ftp://ftp.info-zip.org/pub/infozip/docs/.

Greg