PDFlib 8 Windows COM/.NET Tutorial

3.3.2 Protecting Documents with PDFlib
Encryption algorithm and key length. When creating protected documents PDFlib will
use the strongest possible encryption and key length which are possible with the PDF
compatibility level chosen by the client:
> For PDF 1.3 (Acrobat 4) RC4 with 40-bit keys is used.
> For PDF 1.4 (Acrobat 5) RC4 with 128-bit keys is used.
> For PDF 1.5 (Acrobat 6) RC4 with 128-bit keys is used. This is the same key length as
with PDF 1.4, but a slightly different encryption method will be used which requires
Acrobat 6.
> For PDF 1.6 (Acrobat 7) and above the Advanced Encryption Standard (AES) with 128-
bit keys will be used.
> For PDF 1.7 extension level 3 (Acrobat 9) the Advanced Encryption Standard (AES)
with 256-bit keys will be used. This version also allows Unicode passwords, while all
earlier algorithms support only passwords with characters in WinAnsi encoding.
Passwords. Passwords can be set with the userpassword and masterpassword options in
begin_document( ). PDFlib interacts with the client-supplied passwords in the following
ways:
> If a user password or permissions (see below), but no master password has been supplied,
a regular user would be able to change the security settings. For this reason
PDFlib considers this situation as an error.
> If user and master password are the same, a distinction between user and owner of
the file would no longer be possible, again defeating effective protection. PDFlib considers
this situation as an error.
> For both user and master passwords up to 32 characters are accepted. Empty passwords
are not allowed.
The supplied passwords will be used for all subsequently generated documents.
Security recommendations. For maximum security we recommend the following:
> Use AES encryption unless you must support older viewers than Acrobat 7.
> Documents which have only a master password, but no user password, can always be
cracked. You should therefore consider applying a user password (but of course the
user password must be available to legitimate users of the document).
> Passwords should be at least eight characters long and should contain non-alphabetic
characters. Words which can be found in dictionaries and the names of people or
places should not be used as passwords.
Permissions. Access restrictions can be set with the permissions option in begin_
document( ). It contains one or more access restriction keywords. When setting the
permissions option the masterpassword option must also be set, because otherwise Acrobat
users could easily remove the permission settings. By default, all actions are allowed.
Specifying an access restriction will disable the respective feature in Acrobat. Access
restrictions can be applied without any user password. Multiple restriction
keywords can be specified as in the following example:
p.begin_document(filename, "masterpassword=abcd1234 permissions={noprint nocopy}");
Table 3.3 lists all supported access restriction keywords.
3.3 Encrypted PDF 77