Can anyone explain why this is better than 7zip?
Zstd support and x-platform
7zip 24 supports Zstd
PeaZip: Open-source file compression and encryption software
31–40 of 95 posts
Re: PeaZip: Open-source file compression and encryption software
#32> Offer two factor authentication (password + keyfile) for all formats supporting encryption, to increase security against guessing and dictionary based attacks on weak passwords. uhhh, that’s not how symmetric encryption works. We have salted password-based (PB) KDFs for exactly this purpose. Encryption probably doesn’t belong in the compression container format.
PeaZip also uses a PBKDF (PBKDF2). No longer the latest and greatest, but fine .
I guess I agree with calling PBKDF2 fine, but it may be good to know the caveats:
- Just because it says it uses PBKDF2 doesn't mean it is strong. The strength fully depends on the number of rounds it uses, and especially in legacy (>10 years old) software I see it a lot that some amount of rounds are hardcoded which can now be computed in a few milliseconds on a CPU
- PBKDF2 gives the attacker a ~1000x speedup. If your CPU spends 2 seconds on computing the hash every time, an attacker with a run-of-the-mill GPU spends 2 milliseconds per guess (500 guesses per second). Using something like Bcrypt or Argon2, that speedup gets to iirc "only" 12x (so if you spend 2 seconds, the attacker spends ~170 milliseconds or 6 guesses per second). Iirc this speedup is due to GPU RAM being faster than the main RAM. So while PBKDF2 isn't great, it's also not like it's broken: this has been a known property since forever and it's still orders of magnitude better than a plain hash
Re: PeaZip: Open-source file compression and encryption software
#33Can anyone explain why this is better than 7zip?
I hate that PeaZip does not support passwords with a quotation mark (") in the UI. I haven't reviewed the code, but I am assuming that they are neither passing the password via a variable (linked library) nor via an execve call (less secure), but via some sub-shell which is a common attack vector and bad security practice. But as I said, I haven't reviewed the code.
I haven't ran nor looked at the code for PeaZip, but the website describes the program as a GUI wrapper around command line utilities. I highly suspect it's the sub-shell thing.
Re: PeaZip: Open-source file compression and encryption software
#34[flagged]
Looks fine in portrait on my Samsung galaxy s20 on Firefox. Sure, it's not "mobile first class" websit, but it's a desktop application after all
Re: PeaZip: Open-source file compression and encryption software
#35I've been using this for over a decade. I keep using it because it extracts files directly where you want them, instead of extracting to a temp folder, then copying to where you want, multiplying IO traffic by up to 2. It also lets me use 7z files with zstd compression, though I'm not sure which other software supports it.
Moving files from one directory to another directory on the same filesystem doesn't actually result in any data getting moved, only the directory entries are changed
Let's start slicing the pie, everyone.
On Linux this is becoming a rarity; '/tmp' (the usual $TMPDIR) is mounted using tmpfs, a distinct memory-backed filesystem. Windows on the other hand is happy for this to reside on your physical disk, persistently. I think - this isn't my area.
This almost guarantees your "yes, but" doesn't apply for anyone using Fedora Linux, for example. I dare say nearly any distribution that includes systemd, and probably/consequently, 'tmp.mount'.
While it is memory backed, one can only copy/read from this as fast as the destination can write.
Re: PeaZip: Open-source file compression and encryption software
#36Earlier quoted context omitted.
Moving files from one directory to another directory on the same filesystem doesn't actually result in any data getting moved, only the directory entries are changed
Let's start slicing the pie, everyone. On Linux this is becoming a rarity; '/tmp' (the usual $TMPDIR) is mounted using tmpfs , a distinct memory-backed filesystem. Windows on the other hand is happy for this to reside on your physical disk, persistently. I think - this isn't my area. This almost guarantees your "yes, but" doesn't apply for anyone using Fedora Linux, for example. I dare say nearly any distribution tha…
You shouldn't use /tmp for that for that reason. aunpack for example extracts into a temp directory in the same directory as the final destination.
Re: PeaZip: Open-source file compression and encryption software
#37PeaZip is great software, and doubly so because it is written using Lazarus and compiled with Free Pascal. I highly recommend giving it a try, if only to experience that high quality software can be built using tools that lead you somewhat off the beaten path. Unfortunately, its lead developer has recently posted[0] that he has to undergo what seems to be complicated, major eye surgery, and that he will probably be u…
[deleted]
Re: PeaZip: Open-source file compression and encryption software
#38Earlier quoted context omitted.
Let's start slicing the pie, everyone. On Linux this is becoming a rarity; '/tmp' (the usual $TMPDIR) is mounted using tmpfs , a distinct memory-backed filesystem. Windows on the other hand is happy for this to reside on your physical disk, persistently. I think - this isn't my area. This almost guarantees your "yes, but" doesn't apply for anyone using Fedora Linux, for example. I dare say nearly any distribution tha…
You shouldn't use /tmp for that for that reason. aunpack for example extracts into a temp directory in the same directory as the final destination.
I'm fine with either, I think you and Andrew at the top of the thread agree - PeaZip does as you suggest.
I'm just piling on :D Things that naively use temporary directories otherwise may run into an extra copy... because it's not necessarily on the same filesystem. It's rare, in fact, on modern Linux
Re: PeaZip: Open-source file compression and encryption software
#39PeaZip is great software, and doubly so because it is written using Lazarus and compiled with Free Pascal. I highly recommend giving it a try, if only to experience that high quality software can be built using tools that lead you somewhat off the beaten path. Unfortunately, its lead developer has recently posted[0] that he has to undergo what seems to be complicated, major eye surgery, and that he will probably be u…
I like seeing software written in Free Pascal, they tend to be small and performant. Cheat Engine[0] is another example.
Re: PeaZip: Open-source file compression and encryption software
#40> Offer two factor authentication (password + keyfile) for all formats supporting encryption, to increase security against guessing and dictionary based attacks on weak passwords. uhhh, that’s not how symmetric encryption works. We have salted password-based (PB) KDFs for exactly this purpose. Encryption probably doesn’t belong in the compression container format.
The quote is correct. It does not say they're not using a KDF or salting, which you seem to read into it? The keyfile is the "something you have" and the password "something you know", so two-factor checks out, even if it's not a time-based token that people expect nowadays (though TOTP is essentially the same but on another device, extracting time-based short codes from the long key to make it convenient to type ove…
How is this different from just a keyfile?