ZipFile.TestArchive seems to always return false for AES encrypted zips

[Numpsy]

Steps to reproduce

call

var zipFile = new ZipFile(@"AES.zip")
{
    Password = password
};

Assert.That(zipFile.TestArchive(false), Is.True, "Zip file should be valid");

On an AES encrypted zip file (happens with files generated with both SharpZipLib and 7-Zip).

Expected behavior

I assume that the test should pass for a valid AES archive?

Actual behavior

TestArchive returns false.

Looks like it fails @ https://github.com/icsharpcode/SharpZipLib/blob/master/src/ICSharpCode.SharpZipLib/Zip/ZipFile.cs#L1207 because the flags are different (localFlags just has the encrypted bit set, whereas entry.Flags has the StrongEncryption bit set I think).

If it gets past that, it will also fail on the compression method comparison, as entry.CompressionMethod is the compression format (Deflate), but compressionMethod is 99 (WinZipAES).

Version of SharpZipLib

1.1.0

Obtained from (only keep the relevant lines)

• Compiled from source, commit: 25ee644

[Numpsy]

Actually, looking at the encryption bits of the spec, is it correct to set the strong encryption flag @

SharpZipLib/src/ICSharpCode.SharpZipLib/Zip/ZipEntry.cs

Line 1137 in 25ee644

Flags = Flags | (int)GeneralBitFlags.StrongEncryption;

?
(Seems that is supposed to be for a different encryption approach that the Winzip one)

[piksel]

Yes, the only thing that the AE-1/2 mentions are that the encrypted flag should be set to 1 (bit zero). Strong encryption is what pkzip generally uses to refer to it's (stronger) encryption, so this seems to imply that it should not be set. The APPNOTE only specifies that

Strong encryption. If this bit is set, you MUST set the version needed to extract value to at least 50 and you MUST also set bit 0. If AES encryption is used, the version needed to extract value MUST be at least 51

[Numpsy]

The logic in CreateAndInitDecryptionStream in Zipfile is currently checking for StrongEncryption being set to decide which crypto approach should be used, which seems wrong if StrongEncryption != AE-X, and only the latter is supported?

The check @

SharpZipLib/src/ICSharpCode.SharpZipLib/Zip/ZipFile.cs

Line 3561 in 25ee644

if (entry.Version == ZipConstants.VERSION_AES)

is also checking if the version is equal to 51, when the line you quote above says 'at least 51' and the linked Winzip spec doesn't specify any explicit version - not sure if that is correct?

Possibly the logic should be keyed off the AE-x flags in the entry rather than the other bits?

[piksel]

Indeed, it fails with Central header/local header compression method mismatch. I am taking a look at this.