Morten Zdk - 2022-11-06

The 7z archive files always starts with the bytes hex 0x37_7A_BC_AF_27_1C_00_04 (str "7z..."), even encrypted archives.

Having such a unique header on encrypted archives weakens the value of the encryption, by for example:

  • Direct brute force cracking or use of password list
  • Apply any known weaknesses to 7z archives
  • Remove the option for plausible deniability that the file is not an 7z archive

Suggestion: Remove unique 7z archive header, so 7z archive contents looks like random data.