From: Niklas Frykholm <niklas@...>
Date: 2002-01-22T17:12:46+09:00
Subject: Re: [OT] Re: zip on Linux (or any other *nix)

> 6. Compression is one of the many operations which slows down data
>    encryption.  Generally data is compressed then encrypted so it is
>    less vulnerable to cracking.

This is a common misconception, but with modern cryptosystems including
a compression step does not significantly affect the difficulty of
cracking the encryption. With a brute-force attack, it is just as easy
to recognize compressed plaintext as straight plaintext. Compression
does not affect other common attacks such as known-plaintext,
chosen-plaintext and chosen-ciphertext either. See sci.crypt where this
is (regularily ;) discussed.

Not that it matters anyway. If you are using a strong cryptosystem such
as AES, no one should be able to crack it. The real danger is that
someone steals/guesses your encryption passphrase or obtains the data in
some other non-obvious way (e.g. by installing a Trojan in your
computer).

The reason for the compress-first-then-encrypt rule is thus not to
increase protection. It is just that if you did it the other way around
you would not get any compression.

// Niklas