Download - Multivac!

to disable any access restrictions. This has nothing to do with cracking the encryption;there is simply no way that a PDF file can make sure it won’t be printed while it still remainsviewable. This is actually documented in Adobe’s own PDF reference:There is nothing inherent in PDF encryption that enforces the document permissions specifiedin the encryption dictionary. It is up to the implementors of PDF viewers to respect the intentof the document creator by restricting user access to an encrypted PDF file according tothe permissions contained in the file.9.2.2 Protecting Documents with PDFlibEncryption algorithm and key length. When creating protected documents PDFlib willchoose the strongest possible encryption and key length which are possible with thePDF compatibility level chosen by the client:> For PDF 1.3 (Acrobat 4) RC4 with 40-bit keys is used.> For PDF 1.4 (Acrobat 5) RC4 with 128-bit keys is used. This requires Acrobat 5 or above.> For PDF 1.5 (Acrobat 6) RC4 with 128-bit keys is used. This is the same key length aswith PDF 1.4, but a slightly different encryption method will be used which requiresAcrobat 6.> For PDF 1.6 (Acrobat 7) and above the Advanced Encryption Standard (AES) with 128-bit keys will be used.Passwords. Passwords can be set with the userpassword and masterpassword options inPDF_begin_document( ). PDFlib interacts with the client-supplied passwords in the followingways:> If a user password or permissions (see below), but no master password has been supplied,a regular user would be able to change the security settings. For this reasonPDFlib considers this situation as an error.> If user and master password are the same, a distinction between user and owner ofthe file would no longer be possible, again defeating effective protection. PDFlib considersthis situation as an error.> For both user and master passwords up to 32 characters are accepted. Empty passwordsare not allowed.The supplied passwords will be used for all subsequently generated documents.Good and bad passwords. The strength of PDF encryption is not only determined bythe length of the encryption key, but also by the length and quality of the password. It iswidely known that names, plain words, etc. should not be used as passwords since thesecan easily be guessed or systematically tried using a so-called dictionary attack. Surveyshave shown that a significant number of passwords are chosen to be the spouse’s orpet’s name, the user’s birthday, the children’s nickname etc., and can therefore easily beguessed.While PDF encryption internally works with 40- or 128-bit keys, on the user levelpasswords of up to 32 characters are used. The internal key which is used to encrypt thePDF document is derived from the user-supplied password by applying some complicatedcalculations. If the password is weak, the resulting protection will be weak as well,regardless of the key length. Even 128-bit keys and AES encryption are not very secure ifshort passwords are used.198 Chapter 9: Generating various PDF Flavors