Editing ZIP (file format) (section)

==== Strong encryption controversy ====
When [[WinZip]] 9.0 public beta was released in 2003, WinZip introduced its own [[AES-256]] encryption, using a different file format, along with the documentation for the new specification.<ref>{{cite web|url=http://www.winzip.com/aes_info.htm|title=WinZip – AES Encryption Information|website=Winzip.com|access-date=2017-09-09}}</ref> The encryption standards themselves were not [[Proprietary software|proprietary]], but PKWARE had not updated APPNOTE.TXT to include Strong Encryption Specification (SES) since 2001, which had been used by PKZIP versions 5.0 and 6.0. WinZip technical consultant Kevin Kearney and [[StuffIt]] product manager Mathew Covington accused PKWARE of withholding SES, but PKZIP chief technology officer Jim Peterson claimed that certificate-based encryption was still incomplete.

In another controversial move, PKWare applied for a patent on 16 July 2003 describing a method for combining ZIP and strong encryption to create a secure file.<ref>{{Cite web |url=http://www.infoworld.com/article/03/07/25/HNpkware_1.html |title=PKWare seeks patent for .zip file format |first=Robert |last=McMillan |date=July 25, 2003 |work=InfoWorld.com |access-date=16 June 2008 |archive-url=https://web.archive.org/web/20030810012219/http://www.infoworld.com/article/03/07/25/HNpkware_1.html |archive-date=2003-08-10 |url-status=dead |df=dmy-all }}</ref>

In the end, PKWARE and WinZip agreed to support each other's products. On 21 January 2004, PKWARE announced the support of WinZip-based AES compression format.<ref>{{cite web|url=http://www.news.com/2100-1012_3-5145491.html?tag=fd_nbs_ent|title=Software makers patch Zip tiff|website=News.com|access-date=9 September 2017}}</ref> In a later version of WinZip beta, it was able to support SES-based ZIP files.<ref>{{cite web|url=https://www.theregister.co.uk/2004/01/21/zip_file_encryption_compromise_thrashed/|title=Zip file encryption compromise thrashed out|author=John Leyden|website=Theregister.co.uk|access-date=9 September 2017}}</ref> PKWARE eventually released version 5.2 of the .ZIP File Format Specification to the public, which documented SES.  The [[Free Software]] project [[7-Zip]] also supports AES, but not SES in ZIP files (as does its [[POSIX]] [[Porting|port]] [[p7zip]]).

When using AES encryption under WinZip, the compression method is always set to 99, with the actual compression method stored in an AES extra data field.<ref>{{cite web |url=http://www.winzip.com/win/en/aes_info.htm |title=AES Encryption Information: Encryption Specification AE-1 and AE-2 |website=Winzip.com |access-date=2017-09-09}}</ref> In contrast, Strong Encryption Specification stores the compression method in the basic file header segment of Local Header and Central Directory, unless Central Directory Encryption is used to mask/encrypt metadata.