format: a zip can be locked with ZipCrypto, which is the lock worth having for what it breaks

    tfg generate --format zip --size 30kb --set entries=3 \
      --set password=Secret123 --set encryption=zipcrypto

It is here for what it does to a reader rather than for what it protects.
Measured on our own output: .NET's ZipFile opens one of these, reports the entry
at its true length of 8192, hands back a stream and fills it with ff c7 04 3e
where the file holds "tfg - txt". It never says the entry was encrypted at all,
so an application built on that library processes noise and calls it data. AES
in the same library throws, which is the safer defect and the less interesting
one. This is the fixture PRESETS.md section 4.12 has been describing since
before there was anything to build it with.

The cipher is not ours and it was not taken on trust. It went into
tools/probes/zipcrypto BEFORE it went into the generator, pointed at an archive
7-Zip had written, and asked to decrypt it - check byte, plaintext CRC and the
bytes themselves all came back right. That order was chosen because of what the
AES work had shown a few hours earlier: a mutation proved the archiver guard
could not see a keystream running backwards, since an AE-2 entry signs its
ciphertext rather than its contents, so a file of noise passes every check a
reader makes.

A defect got through anyway, and the probe is what diagnosed it. Every locked
entry declared method 99 - WinZip AES - while a ZipCrypto entry has to stay
stored, because it changes nothing about how the bytes sit and only puts twelve
in front of them. 7-Zip reported "Data Error in encrypted file. Wrong password?"
which points at the password, the one thing that was right. The probe decrypted
the same file perfectly, and that is what moved the suspicion off the
cryptography and onto the header.

So there is a guard for the header shape now, and it asks both schemes in both
directions. ZipCrypto stores, carries the real plaintext CRC and no extra field.
AES declares 99, carries a CRC of nought and a 0x9901 field. Getting either
backwards produces a file that opens and then fails on something that sounds
like the user's fault.

The cost is named rather than hidden: ZipCrypto puts the high byte of the
plaintext CRC in its header, so the contents have to be known before the first
byte of the entry goes out - and the contents arrive as a stream. Each entry is
therefore generated twice, once to be checksummed and once to be encrypted.
Twice the processor and not a byte more memory, because buffering the entry
would break the guard that says a generator does not hold a whole file.

Three guards stopped carrying a hand written list of methods and read the
registry instead. A list in a test is one somebody has to remember on the day a
fourth scheme arrives, and this was that day.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: donislawdev

CHANGELOG.md

@@ -70,6 +70,14 @@ because it turns other people's test suites red.
 
 ### Added
 
+- **A zip can be locked with ZipCrypto, the old scheme.** `--set encryption=zipcrypto`.
+
+  It is here for what it does to a reader rather than for what it protects. Measured: .NET's own `ZipFile` opens one of these, reports the entry at its true length, hands back a stream and fills it with the ENCRYPTED bytes - and never says the entry was encrypted at all. An application built on that library processes noise and calls it data. AES fails loudly in the same library, which is the safer defect and the less interesting one.
+
+  So this is the fixture for finding out whether something in a pipeline waves an encrypted archive through.
+
+  **It is not protection and it is not offered as any.** ZipCrypto has been broken for decades. Use `aes-256` when the point is that the contents are hard to read.
+
 - **A zip can be locked with a password.**
 
       tfg generate --format zip --size 30kb --set entries=3 \

internal/format/archive/archive.go

@@ -61,6 +61,7 @@ const (
 // The encryption methods, spelled the way a recipe writes them.
 const (
 	NoEncryption = "none"
+	ZipCrypto    = "zipcrypto"
 	AES128       = "aes-128"
 	AES192       = "aes-192"
 	AES256       = "aes-256"
@@ -162,10 +163,11 @@ var axes = map[string]format.Property{
 	Encryption: {
 		Name: Encryption, Kind: format.PropertyChoice,
 		// Sorted, because a closed set has one order on every surface.
-		Choices: []string{AES128, AES192, AES256, NoEncryption},
+		Choices: []string{AES128, AES192, AES256, NoEncryption, ZipCrypto},
 		Default: NoEncryption,
-		Detail: "How the archive is locked. This is the WinZip AES scheme, which 7-Zip and WinZip open " +
-			"and some other readers cannot open at all - .NET lists the files and then fails on reading one.",
+		Detail: "How the archive is locked. AES is the WinZip scheme, and some readers cannot open it " +
+			"at all. ZipCrypto is the old one every reader opens and nothing modern trusts, and some " +
+			"of them hand back the encrypted bytes without saying so.",
 	},
 }
 

internal/format/archive/lock.go

@@ -41,6 +41,12 @@ const (
 	authLen    = 10
 	iterations = 1000
 
+	// zipStore is a stored entry, and winZipAES is the number an AES entry
+	// declares instead. The second is not a compression at all: the real method
+	// sits in the 0x9901 field beside it, and this build always stores.
+	zipStore  = 0
+	winZipAES = 99
+
 	// aesExtraLen is the 0x9901 field: two bytes of id, two of length and
 	// seven of body. It is written into the local header AND the central
 	// directory, so an entry pays for it twice.
@@ -64,6 +70,22 @@ type Lock struct {
 // On says whether anything is encrypted.
 func (l Lock) On() bool { return l.Method != "" && l.Method != NoEncryption }
 
+// NeedsPlaintextCRC says whether an entry cannot be started until its
+// contents are known.
+//
+// True for ZipCrypto and false for AES, and the difference is measured rather
+// than assumed. Read out of what 7-Zip writes: a ZipCrypto entry carries the
+// real CRC of the plaintext and puts its high byte in the header, so a reader
+// can reject a wrong password without decrypting anything. An AE-2 entry
+// carries a CRC of zero, because its authentication code does that job.
+//
+// The cost falls on the caller and it is real: an entry that needs this is
+// generated twice, once to be counted and once to be encrypted. Twice the
+// processor and not a byte more memory, which is the trade this project takes
+// every time - holding the file to hash it would break the guard that says a
+// generator does not.
+func (l Lock) NeedsPlaintextCRC() bool { return l.Method == ZipCrypto }
+
 // keyLen is the AES key in bytes, and the salt is half of it. Zero for an
 // archive that is not locked with AES.
 func (l Lock) keyLen() int {
@@ -98,6 +120,7 @@ func (l Lock) strength() byte {
 // Measured, and it agrees from two directions - the size of the whole file and
 // the compressed size field in the local header:
 //
+//	ZipCrypto   +12   (eleven bytes that vary and one check byte)
 //	AES-128     +20   (8 salt, 2 verifier, 10 authentication)
 //	AES-192     +24
 //	AES-256     +28
@@ -106,12 +129,34 @@ func (l Lock) strength() byte {
 // headers are written for real during the counting pass, so the writer counts
 // those eleven bytes twice over on its own.
 func (l Lock) EntryOverhead() int64 {
-	if !l.On() {
+	switch {
+	case !l.On():
 		return 0
+	case l.Method == ZipCrypto:
+		return zipCryptoHeader
 	}
 	return int64(l.saltLen() + pwvLen + authLen)
 }
 
+// ZipMethod is the compression method the entry declares. Named for what it
+// answers rather than for the field it reads, because Method is that field.
+//
+// AES entries declare 99, which is not a compression at all - the real
+// method sits in the 0x9901 field beside it. ZipCrypto declares what it
+// really is, because it changes nothing about how the bytes are stored, it
+// only puts twelve bytes in front of them and scrambles what follows.
+//
+// Getting this wrong is quiet. An entry declaring 99 with no 0x9901 field
+// beside it gets past the check byte and fails on the checksum, and 7-Zip
+// reports "Data Error in encrypted file. Wrong password?" - which points at
+// the password, the one thing that was right.
+func (l Lock) ZipMethod() uint16 {
+	if l.keyLen() == 0 {
+		return zipStore
+	}
+	return winZipAES
+}
+
 // Extra is the 0x9901 field an AES entry carries, and nil for anything else.
 func (l Lock) Extra() []byte {
 	if l.keyLen() == 0 {
@@ -185,7 +230,10 @@ func ReadLock(id string, props map[string]string) (Lock, error) {
 // would give two runs of one recipe different bytes, which is untouchable rule
 // 3 - and the same recipe producing the same file is more of the product here
 // than the encryption is.
-func (l Lock) NewEntryWriter(w io.Writer, seed uint64, index int) (io.WriteCloser, error) {
+func (l Lock) NewEntryWriter(w io.Writer, seed uint64, index int, crc uint32) (io.WriteCloser, error) {
+	if l.Method == ZipCrypto {
+		return l.newZipCryptoWriter(w, seed, index, crc)
+	}
 	if l.keyLen() == 0 {
 		return nil, fmt.Errorf("archive: %q is not an encryption this build can write", l.Method)
 	}

internal/format/archive/zipcrypto.go

@@ -0,0 +1,126 @@
+package archive
+
+import (
+	"hash/crc32"
+	"io"
+
+	"github.com/donislawdev/TestingFilesGenerator/internal/core"
+)
+
+// The old ZIP encryption, the one everything opens and nothing modern trusts.
+//
+// It is here for what it does to a reader rather than for what it protects.
+// Measured on 2026-09-01: .NET's own ZipFile opens a ZipCrypto archive, reports
+// the entry at its true length, hands back a stream and fills it with
+// CIPHERTEXT - 'ea 59 89 8e' where the file holds 'AAAA' - and never says the
+// entry was encrypted at all. An application built on that library processes
+// noise and calls it data. AES fails loudly in the same library, which is the
+// safer defect and the less interesting one.
+//
+// So this is the fixture that finds a real class of fault, and it is the one
+// the presets have been waiting for: PRESETS.md section 4.12 names "an archive
+// with a password waved through without warning" as a thing to catch.
+//
+// The cipher itself is not ours and was not taken on trust. It was written into
+// a probe first, pointed at an archive 7-Zip produced, and asked to decrypt it -
+// the check byte, the plaintext CRC and the bytes themselves all came back
+// right. tools/probes/zipcrypto, and it stays runnable, because a keystream
+// that is subtly wrong produces a file some readers still accept.
+
+const (
+	// The three keys PKWARE starts from and the multiplier it steps them with.
+	// Constants of the scheme rather than choices of ours.
+	key0Init   = 305419896
+	key1Init   = 591751049
+	key2Init   = 878082192
+	multiplier = 134775813
+
+	// zipCryptoHeader is the twelve bytes that precede an entry's data: eleven
+	// that vary and one that lets a reader reject a wrong password without
+	// decrypting anything else. It is the whole of what this scheme adds, which
+	// is why the overhead is a constant.
+	zipCryptoHeader = 12
+)
+
+var crcTable = crc32.MakeTable(crc32.IEEE)
+
+// pkware is the stream cipher, keyed by a password and then by every byte of
+// plaintext that passes through it.
+//
+// The plaintext updates the keys in both directions, which is why encrypting
+// and decrypting are two functions here rather than one - a stream cipher that
+// is its own inverse would not need the distinction, and this one is not.
+type pkware struct{ k0, k1, k2 uint32 }
+
+func newPKWARE(password string) *pkware {
+	c := &pkware{k0: key0Init, k1: key1Init, k2: key2Init}
+	for i := 0; i < len(password); i++ {
+		c.update(password[i])
+	}
+	return c
+}
+
+func (c *pkware) update(p byte) {
+	c.k0 = crcTable[(c.k0^uint32(p))&0xff] ^ (c.k0 >> 8)
+	c.k1 += c.k0 & 0xff
+	c.k1 = c.k1*multiplier + 1
+	c.k2 = crcTable[(c.k2^(c.k1>>24))&0xff] ^ (c.k2 >> 8)
+}
+
+func (c *pkware) keyByte() byte {
+	t := uint16(c.k2|2) & 0xffff
+	return byte((t * (t ^ 1)) >> 8)
+}
+
+func (c *pkware) encrypt(p byte) byte {
+	x := p ^ c.keyByte()
+	c.update(p)
+	return x
+}
+
+// zipCryptoWriter encrypts on the way through, header first.
+type zipCryptoWriter struct {
+	out io.Writer
+	c   *pkware
+}
+
+// newZipCryptoWriter starts an entry, writing the twelve byte header before
+// anything else.
+//
+// The eleven bytes that vary come from the run seed and never from crypto/rand,
+// for the reason every other draw in this tool avoids it: two runs of one
+// recipe have to give one file. The twelfth is the high byte of the plaintext
+// CRC, and it is why this scheme needs the contents known before the first byte
+// goes out - the whole reason a ZipCrypto entry is generated twice.
+func (l Lock) newZipCryptoWriter(w io.Writer, seed uint64, index int, crc uint32) (io.WriteCloser, error) {
+	c := newPKWARE(l.Password)
+	rng := core.NewRand(core.FileSeed(seed, index))
+
+	header := make([]byte, zipCryptoHeader)
+	for i := range header[:zipCryptoHeader-1] {
+		header[i] = byte(rng.Uint32())
+	}
+	header[zipCryptoHeader-1] = byte(crc >> 24)
+	for i := range header {
+		header[i] = c.encrypt(header[i])
+	}
+	if _, err := w.Write(header); err != nil {
+		return nil, err
+	}
+	return &zipCryptoWriter{out: w, c: c}, nil
+}
+
+func (z *zipCryptoWriter) Write(p []byte) (int, error) {
+	out := make([]byte, len(p))
+	for i := range p {
+		out[i] = z.c.encrypt(p[i])
+	}
+	if _, err := z.out.Write(out); err != nil {
+		return 0, err
+	}
+	return len(p), nil
+}
+
+// Close has nothing to finish. ZipCrypto signs nothing - the entry's own CRC is
+// what a reader checks, after decrypting, if it checks at all.
+func (z *zipCryptoWriter) Close() error { return nil }

internal/format/zip/zip.go

@@ -9,6 +9,7 @@ import (
 	stdzip "archive/zip"
 	"context"
 	"fmt"
+	"hash/crc32"
 	"io"
 	"strings"
 	"time"
@@ -48,11 +49,6 @@ const (
 	fillerName = "tfg-padding.bin"
 
 	writeChunk = 32 * 1024
-
-	// winZipAES is the compression method a locked entry declares. It is
-	// not a compression at all - the real method sits in the 0x9901 field
-	// and is store, like everything else here.
-	winZipAES = 99
 )
 
 // A fixed timestamp on every entry. Taking one from the clock would make two
@@ -414,6 +410,11 @@ type entryPlan struct {
 	index int
 	// withContents is false during the pass that only measures.
 	withContents bool
+	// crc is the checksum of the contents, and it is only ever filled for a
+	// lock that needs the contents known before the first byte. Zero
+	// otherwise, which is what an AE-2 entry carries anyway and what the
+	// counting pass writes into a header nobody reads.
+	crc uint32
 }
 
 // openEntry starts the next entry and gives back what its contents go to.
@@ -447,14 +448,14 @@ func openEntry(zw *stdzip.Writer, m memo, e entryPlan) (io.Writer, func() error,
 
 	h := &stdzip.FileHeader{
 		Name:     e.name,
-		Method:   winZipAES,
+		Method:   m.lock.ZipMethod(),
 		Modified: fixedTime,
 		Extra:    m.lock.Extra(),
 	}
 	// Bit 0 says the entry is encrypted. The CRC stays zero because AE-2
 	// carries none - which is what lets the contents be written in one pass.
 	h.Flags |= 1
-	h.CRC32 = 0
+	h.CRC32 = e.crc
 	h.CompressedSize64 = uint64(e.plain + m.lock.EntryOverhead())
 	h.UncompressedSize64 = uint64(e.plain)
 
@@ -470,13 +471,42 @@ func openEntry(zw *stdzip.Writer, m memo, e entryPlan) (io.Writer, func() error,
 		// which is what the engine caught when this was written the other way.
 		return raw, nothingToShut, nil
 	}
-	locked, err := m.lock.NewEntryWriter(raw, m.seed, e.index)
+	locked, err := m.lock.NewEntryWriter(raw, m.seed, e.index, e.crc)
 	if err != nil {
 		return nil, nil, err
 	}
 	return locked, locked.Close, nil
 }
 
+// plaintextCRC is the checksum of what an entry is about to hold, worked out
+// by generating it once and throwing the bytes away.
+//
+// Only ZipCrypto asks for this, and only when the contents are really being
+// written. That scheme puts the high byte of the plaintext CRC in the twelve
+// byte header it prepends, so a reader can turn away a wrong password without
+// decrypting anything - which means the checksum has to be known before the
+// first byte of the entry goes out, and the contents arrive as a stream.
+//
+// Generating twice rather than buffering, and that is the trade taken
+// deliberately. Holding the entry to hash it would break the guard that says
+// a generator does not keep a whole file in memory, and the second pass is
+// free of risk because a generator producing different bytes on two calls in
+// one process is itself a guarded impossibility. It costs processor time on
+// locked archives and nothing at all on open ones.
+func plaintextCRC(ctx context.Context, m memo, withContents bool, write func(io.Writer) error) (uint32, error) {
+	if !withContents || !m.lock.NeedsPlaintextCRC() {
+		return 0, nil
+	}
+	sum := crc32.NewIEEE()
+	if err := write(sum); err != nil {
+		return 0, err
+	}
+	if err := ctx.Err(); err != nil {
+		return 0, err
+	}
+	return sum.Sum32(), nil
+}
+
 // build writes the archive.
 //
 // withContents says whether the files inside are actually generated. The
@@ -500,8 +530,14 @@ func build(ctx context.Context, w io.Writer, m memo, withContents bool) error {
 		default:
 		}
 
+		crc, err := plaintextCRC(ctx, m, withContents, func(w io.Writer) error {
+			return c.desc.Generator.Write(ctx, w, c.plan)
+		})
+		if err != nil {
+			return fmt.Errorf("zip: the %s file inside could not be checksummed: %w", c.desc.ID, err)
+		}
 		entry, shut, err := openEntry(zw, m, entryPlan{
-			name: c.name, plain: c.plan.Bytes, index: i, withContents: withContents,
+			name: c.name, plain: c.plan.Bytes, index: i, withContents: withContents, crc: crc,
 		})
 		if err != nil {
 			return err
@@ -520,8 +556,15 @@ func build(ctx context.Context, w io.Writer, m memo, withContents bool) error {
 		// The filler is locked with everything else. An archive where one entry
 		// opens without the password and the rest do not is a file nobody
 		// asked for, and the arithmetic is the same either way.
+		crc, err := plaintextCRC(ctx, m, withContents, func(w io.Writer) error {
+			return writeFiller(ctx, w, m.seed, m.fillerSize)
+		})
+		if err != nil {
+			return err
+		}
 		entry, shut, err := openEntry(zw, m, entryPlan{
-			name: fillerName, plain: m.fillerSize, index: len(m.children), withContents: withContents,
+			name: fillerName, plain: m.fillerSize, index: len(m.children),
+			withContents: withContents, crc: crc,
 		})
 		if err != nil {
 			return err