Brian Tillman said:
From what I've read, there are easily obtainable cracking tools for
zip file passwords. A digital certificate on both sides would be
better, in my opinion.
If there is only 1 file contained with a .zip file, the only method
usable is brute force. The length of the password significantly impacts
how many guesses it will take to find the password. While a
14-character password would take millions of years to try every possible
combination of characters (but it could always succeed on the first
guess, too), a 5-character password would take just a few days, or even
less. The more files that saved within a .zip file (up to 5), the
easier it is to crack the password using non-brute force methods (I.e.,
weaknesses in the encrypting process in creating the container with
those multiple files).
I have to wonder just how the OP is going to transmit the password used
to encrypt the attached .zip file. Are they going to phone the password
to the e-mail recipient? If so, and if they were concerned about their
network getting sniffed then why wouldn't they be concerned about
wiretapping their phone line? Are they going to include the password in
the e-mail that has the attached encrypted file? That's like taping the
key to a padlock that you use on your shed: anyone can use the key to
get inside so there was no point in using the padlock in the first
place. If they intend to send a separate e-mail with the password, what
stops the intruder from grabbing that 2nd e-mail with the password that
the sender was afraid was going to snatch a copy of their 1st e-mail
with the encrypted file? That's like mailing a padlocked package
through the mail and then mailing the key to the padlock and assuming
that the postal carrier that you are afraid of getting into the lockbox
won't also use the key that you sent through the mail.
The OP needs to look into how to use encrypted e-mails, not how to
encrypt attachments to them. Sending encrypted e-mails also requires
NOT using freebie e-mail services that like to append the promotional
spam signatures onto outbound e-mails sent through their so-called
"free" service. The addition of the spam signature will alter the
e-mail body and result in a mismatch for the hash code of the body of
the original e-mail that got encrypted. The recipient of the encrypted
e-mail will be told that the encryption has been corrupted which means
they cannot trust its content.
