Re: [cti-cybox] File/Artifact Encryption & Archive Properties

["Back, Greg" <gback@mitre.org>]

An encrypted zip file is different than just encrypting (and compressing) the file contents. Doing this would lose the mime_type of the file being compressed in the archive (if this is important).

(We went around on this quite a bit in CybOX 2.0)

Greg

On 2017-10-04, 14:45 UTC, "Trey Darley" <cti-cybox@lists.oasis-open.org on behalf of trey@newcontext.com> wrote:

    On 28.09.2017 17:17:01, John-Mark Gurney wrote:
    > Jason Keirstead wrote this message on Mon, Sep 25, 2017 at 10:43 -0300:
    > > ... But that is the problem I am pointing out.
    > > 
    > > Having a blob of bytes and knowing it is encrypted with AES-256 is
    > > not sufficient to open it. I have to know that it is encrypted
    > > using Zip encryption with AES-256, or 7zip encryption with
    > > AES-256, as these are different things.
    > 
    
    Hey, y'all -
    
    If you put `mime_type: "x-7z-compressed"` and `encryption_algorithm:
    "AES-256"` on the example Artifact being discussed, what's the
    problem?
    
    -- 
    Cheers,
    Trey
    ++--------------------------------------------------------------------------++
    Director of Standards Development, New Context
    gpg fingerprint: 3918 9D7E 50F5 088F 823F  018A 831A 270A 6C4F C338
    ++--------------------------------------------------------------------------++
    --
    "Gentlemen, you can't fight in here! This is the War Room!"
    --President Merkin Muffley