Offset     Size(bytes)     Content
0     2     Extra field header ID (0x9901)
2     2     Data size (currently 7, but subject to possible increase in the future)
4     2     The "Integer version number specific to the zip vendor"
6     2     2-character vendor ID
8     1     Integer mode value indicating AES encryption strength
9     2     The actual compression method used to compress the file

  IZipCryptor = interface(IInterface)
    ['{CB1D5970-6CCC-402D-BAAD-02ED425ED07B}']
    procedure Init(const APassword: string; AEncrypt: Boolean);
    procedure Decrypt(var Buffer: TBytes);
    procedure Encrypt(var Buffer: TBytes);
  end;

  TEncryptedFileHeader: array [0..10] of byte = (
    $01, $99, 7, 0, 2, 0, $41, $45, 3, 8, 0);

  TEncryptionType = (etnone, etae1, etae2); // no encryption, AE-1 encryption, AE-2 encryption

    NumberOfIterations = 1000;

    FPassword: string;    // the original user password provided by the user
    FKey: TBytes;         // the key derived with PBKDF2 and stored in bytes 1 to 32 of the resulting sequence    
    FSalt: TBytes;        // the random salt used by PBKDF2, together with the password
    FAuthSalt: TBytes;    // the second salt, computed with PBKDF2 and stored in bytes 33 to 64 of the resulting sequence
    FVerifCode: TBytes;   // the verification code, stored in bytes 65 and 66 of the resulting sequence

    procedure Init(const APassword: string; var Data: TBytes; AEncrypt: Boolean);
        APassword: always required
        Data: collects bytes generated when decrypting (needs to be allocated then), not used to encrypt
        AEncrypt: set to true when encrypting, to false otherwise    

    procedure GetSeedAndCode(var Seed: TBytes; var Code: TBytes); // used to get parameters when encrypting, Seed is salt2 to generate the Authentication Code
    function  ComputeAuthenticationCode(CryptoGram: TBytes): TBytes; // generates the Authentication Code for both encryption and decryption (used to verify integrity in decryption mode)

// encryption example
procedure TMainForm.EncryptBtnClick(Sender: TObject);
var
  ZC: TZCClass;

begin
  if OpenDialog.Execute = false then // get a file name from the opendialog box
    Exit;

  ZC := TZCClass.Create('.\encryptedTest.zip', PwdEdit.Text); // PwdEdit.Text contains the user password
  ZC.EncryptionType := etae2;
  ZC.FileList.Add(OpenDialog.FileName); // in this example, one file is added to the class file list, before being compressed and encrypted
  try
    // Create a new ZIP file
    ZC.EncryptZipArchive;

  finally
    ZC.Free;
  end;
end;

// decryption example
procedure TMainForm.DecryptBtnClick(Sender: TObject);
var
  ZC: TZCClass;

begin
  if OpenDialog.Execute = false then
    Exit;

  try
    ZC := TZCClass.Create(OpenDialog.FileName, PwdEdit.Text);
    ZC.DecryptZipArchive; // done! files decrypted, extracted, created

    // let's play a bit
    case ZC.EncryptionType of
      etnone: MainMemo.Lines.Add('ZIP file is in the clear');
      etae1:  MainMemo.Lines.Add('ZIP file is encrypted in AE-1 mode');
      etae2:  MainMemo.Lines.Add('ZIP file is encrypted in AE-2 mode');
    end;

  finally
    ZC.Free;
  end;
end;