JDK-4347142 : Need method to set Password protection to Zip entries
  • Type: Enhancement
  • Component: core-libs
  • Sub-Component: java.util.jar
  • Affected Version: 1.3.0,1.4.2
  • Priority: P4
  • Status: Closed
  • Resolution: Won't Fix
  • OS: generic,windows_xp
  • CPU: generic,x86
  • Submitted: 2000-06-21
  • Updated: 2024-11-19
  • Resolved: 2024-11-19
Related Reports
Relates :  
JDK-8145260 - To bring j.u.z.ZipFile's native implementation to Java to remove the expensive jni cost and mmap crash risk [2]
Relates :  
JDK-6502004 - ZipFile constructor throws ZipException when encrypted entries are present
Description

Name: skT45625			Date: 06/21/2000


java version "1.3.0"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.3.0-C)
Java HotSpot(TM) Client VM (build 1.3.0-C, mixed mode)

We are on the process of converting our ActiveX control which zip's a users
local files add password protection to zip entries and uploads these zip files
to his/her account on the host. However the current zip classes provided by JDK
(ZipEntry, ZipOutputStream etc..) does not have a method to set the password of
the zip entry. This is crucial to our application and hope the java team can
develop this feature in its next release.
(Review ID: 106388) 
======================================================================
Comments
Closing this 24 years old issue as won't fix. The justification is that * java.util.zip.ZipFile is an old API which main purpose is to support class loading in Java. * The security of password-protected ZIP files is dubious * Implementing support is a significant effor, incurring many API and implementation changes. * Third-party Java implementations exist.
19-11-2024
We found to implement it without modifying zlib. Our patch and testcase is available in maillist as below: http://mail.openjdk.java.net/pipermail/core-libs-dev/2015-November/036960.html Our customers need ZIP encryption / decryption. So we want to move forward this issue.
26-11-2015
EVALUATION Sun's Java SE implementation uses zlib. From the FAQ at: http://www.zlib.net/zlib_faq.html#faq38 <quote> How can I encrypt/decrypt zip files with zlib? zlib doesn't support encryption. The original PKZIP encryption is very weak and can be broken with freely available programs... </quote> The PKWare specification at: http://www.pkware.com/support/zip-application-note suggests that, as of version 6.2.1 (perhaps earlier?), stronger encryption is possible. However, (a) zlib does not support this, (b) the appnote states that use of this newer technology is covered under a pending patent application. In light of the open sourcing of the JDK, it is questionable if this can be adopted (but note that I am not a lawyer and nothing here should be construed as a legal opinion).
11-06-2008
EVALUATION I'm not sure this is possible with the INFO-ZIP libraries we are using. I'm not sure they support the password feature as done with the PKZIP implementation. andrew.bennett@eng 2000-11-15
15-11-2000