|
|||||||
|
|
![]() |
|
|
PKWARE Issues New ZIP Spec with Added Security Features by Alex Woodie "Hey, this is pretty neat." Those are the immortal words of the late Phil Katz, developer of the ZIP file compression technology, upon discovering, at his mother's dining room table, that people would actually pay him for the software he offered for free. Katz went on to sell PKZIP products through his company, PKWARE, but he always maintained ZIP in the public domain. PKWARE is keeping Katz's tradition alive by issuing a new ZIP specification. Earlier this year, PKWARE teamed with RSA Security to add support for up to 256-bit Advanced Encryption Standard (AES) password-based encryption to PKWARE's PKZIP Professional products for Windows, Linux, Unix, OS/400, and MVS. With this new capability, any document or file compressed and encrypted by any PKZIP product also can be decrypted, decompressed, and opened by any one of them. The products also support DES, 3DES, RC2, and RC4 encryption algorithms. The new encryption-enabled versions of the PKZIP products have seen sufficient stable use over the last several months in order for PKWARE officials to feel comfortable handing the new capability to the public realm. Last week the company released Application Note 5.2, which provides technical details on the password-based encryption capabilities of the cross-platform PKZIP products. A copy of Application Note 5.2 is available on the PKWARE Web site. Application Note 5.2 documents the internal flags required to support BZIP2 compression, the record layouts for MVS and OS/400, and defines a new storage location reserved for pending Unicode file name support. The specification also includes new mappings for compatible third-party extensions to the ZIP format, including the specific file attribute storage used by the ZipIt program. The Application Note document is primarily used by developers, and even by PKWARE competitors, to embed the PKZIP compression technology in their applications. Now, with Application Note 5.2, developers can add password-protected encryption to the file compression. "In keeping with the tradition set by founder Phil Katz, we want to ensure complete interoperability not only across multiple platforms but also across multiple vendors' ZIP-compatible products," says Jim Peterson, PKWARE's chief technical officer. "The release of this specification supports this effort." PKWARE is also working to bring certificate-based strong encryption capabilities to its cross-platform product line. Currently, the company offers public key infrastructure (PKI) based encryption for its Unix and Windows products. The company is working to deliver this capability to its mainframe and OS/400 products, but it is not ready to give a timeline for its completion, Peterson says. Like the new password-protected encryption, after PKWARE's certificate-based encryption has been shaken out and deemed stable among the PKZIP user base, PKWARE will release that capability into the public realm. PKWARE also announced changes to its specification and Application Note release cycle. Previously, it has been somewhat of an ad hoc, loosely defined process, with new specifications coming out on an irregular basis, Peterson says. In response to feedback from the developers that use the PKWARE technology, which number between 80 to 100 known companies, Peterson and his team have decided to establish a set of milestones to guide the new capability to full release. Upon introduction of a new capability to PKZIP, the company will try to have the initial documentation completed within nine months, then have the final documentation delivered as a revision to Application Note three to six months later.
|
Editor
Contact the Editors |
| Copyright © 1996-2008 Guild Companies, Inc. All Rights Reserved. |