You currently use a static initialisation vector (of all-0). This is insecure.
I don't mean to be too pushy about this, but it may be prudent to replace the OpenSSL dependency with RustCrypto's AEADs where possible, which are considerably more difficult to misuse, and which will also automatically alert on decryption failure due to a wrong encryption key.
(I don't know the specifics of the original zip program this one is modelled after. Apologies if the zero-IV is needed for compatibility, though explaining that in the source file may be helpful in that case.)
You currently use a static initialisation vector (of all-
0). This is insecure.I don't mean to be too pushy about this, but it may be prudent to replace the OpenSSL dependency with RustCrypto's AEADs where possible, which are considerably more difficult to misuse, and which will also automatically alert on decryption failure due to a wrong encryption key.
(I don't know the specifics of the original
zipprogram this one is modelled after. Apologies if the zero-IV is needed for compatibility, though explaining that in the source file may be helpful in that case.)