4 ms·
Looks like a fine start. Compressing chunks together seems pretty dangerous; the ZIP file part is only safe if it doesn't compress.
by brians 12y ago
Looks like a fine start. Compressing chunks together seems pretty dangerous; the ZIP file part is only safe if it doesn't compress.
- HerraBRE 12y agoThere have been some security flaws related to compressing data before encrypting it - I don't know if those apply here. But if they do, well, compression is actually optional in the ZIP standard. This would need to be checked carefully if this moves beyond the discussion stage. The purpose of using an archive was primarily to have a standard container for transmitting filenames and metadata, which recipients won't need to install extra tools to work with.
- JoshTriplett 12y agoIf you use ZIP, some implementations will compress, and you'll get security vulnerabilities. And even if your implementation rejects compressed ZIP files, other implementations won't. Better to use a container that doesn't support compression and never will; for instance, tar. PGP/GPG has compression support built-in, for that matter; I wonder if anyone has looked for vulnerabilities like CRIME or BREACH in it?
- HerraBRE 12y agoI suggested ZIP simply because it's so widely supported, it's built into the stdlibs of many higher level languages and most operating systems have GUI tools to browse the contents. I don't know of any other containers that are as widely supported, but I am all ears. If it's a container that requires the recipient install 3rd party tools, then we may as well skip that part of the proposal entirely.