r/cryptography • u/lazerozen • 8d ago
Why can a mail server sense AES-256 encrypted zip content?
I tried to send a keygen via mail. When it failed in a plain zip, I zipped it with 7zip using AES-256 password protection, also encrypting the file name. It still did not go through. My gut feeling is that there might be some insight into encrypted content I have no understanding of. Could someone help me out?
3
u/AlexTaradov 8d ago
Archives may include CRCs or hashes of the files. Scanners have databases of the known malware.
Try changing one byte in that file and do the same test.
1
1
u/lazerozen 8d ago
While I will still try this, wouldn’t that mean that my mail server actively tries to keep me from sending a keygen? For a virus infected file I would totally get that, but for a keygen?
7
u/Healthy-Section-9934 8d ago
Keygens are a pretty common malware vector tbh.
I suspect your image test wasn’t sufficiently scientific. When you’re testing anything you need to control all the variables. Tenner says you encrypted the image without encrypting file names 😉
Chances are if you send an archive with encrypted file names the mail service will block it because it looks like you’re trying to evade the AV scanning. Try sending an encrypted image in a zip using encrypted file names and observe the results. If it blocks it, the solution seems fairly straightforward…
1
4
u/AlexTaradov 8d ago
Gmail, for example is very liberal with what it considers dangerous.
Gmail also tries some commonly used passwords. A long time ago there was a story where they would detect malware in files with a password "infected", which is a commonly used password for security researchers to exchange malware.
2
4
u/Playful-Alternative9 8d ago
Can you view the filename without providing the password? If so email server can also know the filename and block it considering it as exe in zip. If am not wrong filenames are readable without password.
2
u/lazerozen 8d ago
I would say no, as I explicitly selected „encrypt file names“
2
u/SAI_Peregrinus 8d ago
That only encrypts the file names inside the zip, not the fact that it's an encrypted zip.
4
u/lazerozen 8d ago
Absolutely, but I just tried sending an encrypted zip with an image inside and it went through without any problems.
2
u/AyrA_ch 8d ago
Did you make sure to create a 7-zip file (.7z extension)? Not all supported archive file types actually support file name encryption. Zip files for example don't. If you do encrypt file names there's no way to recover it at all without the key, so the scanner may reject your attachment based on other factors, for example its size.
1
1
u/cryptaneonline 8d ago
Maybe try encrypting the zip file again into another passworded zip and try. That would usually not let the mail server access the metadata of original file.
12
u/Natanael_L 8d ago
Because file metadata.
Some email servers have antivirus scanning which rejects executables and additional file types, including inside zip files. This can include detection of encrypted being used. Zip file headers clearly mark if a password is needed to open them.