Layer7 API Management

 View Only
  • 1.  Password protection of zip file with layer7

    Posted Jun 25, 2020 11:09 AM
    Hi,
    I am making a policy where i am getting the data in a zip file. Now i want to password protect that zip file and email that to the requestor. I do not find any way to password protect it. As of now i am sending the zip file in email. Please guide on how to password protect the zip.


  • 2.  RE: Password protection of zip file with layer7
    Best Answer

    Broadcom Employee
    Posted Jun 26, 2020 12:00 PM
    That's a very customized flow, and difficult for us to support directly in a general purpose gateway. You would have to build that yourself with the custom assertion SDK. Gateway directly doesn't support unzip/rezip with a password in policy primitives. We support gzip and compress, but not with passwords - which is a type of encryption.

    The gateway includes the ability to do many forms of public key cryptography, but zip with password is considered shared secret cryptography, and zip with password isn't a particularly standard security protocol. As far as I know, that format is vulnerable to brute force attacks. 

    However, assuming the point of what you're doing is to make it that only one reciepient can read the contents of the zip, that was what WS-SecureEncryption was designed to do, and you can do that in the gateway, but instead of a password, it uses the recipient's public key to encrypt the file. They need their private key to decrypt it.

    ------------------------------
    Architect
    Broadcom
    ------------------------------