Apache PDFBox 3.0.4 · org.apache.pdfbox.pdmodel.encryption.SecurityHandler

Modifier and Type	Field and Description
private static final byte[]	AES_SALT
private AccessPermission	currentAccessPermission The access permission granted to the current user for the document.
private SecureRandom	customSecureRandom Can be used to allow stateless AES encryption
private boolean	decryptMetadata Indicates if the Metadata have to be decrypted of not.
private static final short	DEFAULT_KEY_LENGTH
private byte[]	encryptionKey The encryption key that will be used to encrypt / decrypt.
private short	keyLength The length in bits of the secret key used to encrypt the document.
private static final Log	LOG
private final Set<COSBase>	objects
private T_POLICY	protectionPolicy The typed `ProtectionPolicy` to be used for encryption.
private final RC4Cipher	rc4 The RC4 implementation used for cryptographic functions.
private COSName	streamFilterName The stream filter name.
private COSName	stringFilterName The string filter name.
private boolean	useAES

Access	Constructor and Description
protected	SecurityHandler() Constructor.
protected	SecurityHandler(T_POLICY The protection policy. protectionPolicy) Constructor used for encryption.

Method Summary

Modifier and Type	Method and Description
private byte[]	Returns: the calculated key. calcFinalKey(long The data object number. objectNumber, long The data generation number. genNumber) Calculate the key to be used for RC4 and AES-128.
protected int	Returns: The computed version number. computeVersionNumber() Computes the version number of the `SecurityHandler` based on the encryption key length.
private Cipher	createCipher(byte[] key, byte[] iv, boolean decrypt)
public void	decrypt(COSBase The object to decrypt. obj, long The object number. objNum, long The object generation Number. genNum) This will dispatch to the correct method.
private void	decryptArray(COSArray The array to decrypt. array, long The object number. objNum, long The object generation number. genNum) This will decrypt an array.
private void	decryptDictionary(COSDictionary The dictionary to decrypt. dictionary, long The object number. objNum, long The object generation number. genNum) This will decrypt a dictionary.
public void	decryptStream(COSStream The stream to decrypt. stream, long The object number. objNum, long The object generation number. genNum) This will decrypt a stream.
private void	decryptString(COSString the string to decrypt. string, long The object number. objNum, long The object generation number. genNum) This will decrypt a string.
private void	encryptData(long The data object number. objectNumber, long The data generation number. genNumber, InputStream The data to encrypt. data, OutputStream The output to write the encrypted data to. output, boolean true to decrypt the data, false to encrypt it. decrypt) Encrypt or decrypt a set of data.
private void	encryptDataAES256(InputStream The data to encrypt. data, OutputStream The output to write the encrypted data to. output, boolean true to decrypt the data, false to encrypt it. decrypt) Encrypt or decrypt data with AES256.
private void	encryptDataAESother(byte[] The final key obtained with via `calcFinalKey(long, long)`. finalKey, InputStream The data to encrypt. data, OutputStream The output to write the encrypted data to. output, boolean true to decrypt the data, false to encrypt it. decrypt) Encrypt or decrypt data with AES with key length other than 256 bits.
protected void	encryptDataRC4(byte[] The final key obtained with via `calcFinalKey(long, long)`. finalKey, InputStream The data to encrypt. input, OutputStream The output to write the encrypted data to. output) Encrypt or decrypt data with RC4.
protected void	encryptDataRC4(byte[] The final key obtained with via `calcFinalKey(long, long)`. finalKey, byte[] The data to encrypt. input, OutputStream The output to write the encrypted data to. output) Encrypt or decrypt data with RC4.
public void	encryptStream(COSStream The stream to decrypt. stream, long The object number. objNum, int The object generation number. genNum) This will encrypt a stream, but not the dictionary as the dictionary is encrypted by visitFromString() in COSWriter and we don't want to encrypt it twice.
public void	encryptString(COSString the string to encrypt. string, long The object number. objNum, int The object generation number. genNum) This will encrypt a string.
public AccessPermission	Returns: the access permissions or null if the document was not decrypted. getCurrentAccessPermission() Returns the access permissions that were computed during document decryption.
public byte[]	Returns: The current encryption key data. getEncryptionKey() Returns the current encryption key data.
public int	Returns: Returns the keyLength in bits. getKeyLength() Getter of the property keyLength.
protected T_POLICY	Returns: The set `ProtectionPolicy`. getProtectionPolicy() Returns the set `ProtectionPolicy` or null.
private SecureRandom	Returns: SecureRandom getSecureRandom() Returns a SecureRandom If customSecureRandom is not defined, instantiate a new SecureRandom
public boolean	Returns: true if a protection policy has been set. hasProtectionPolicy() Returns whether a protection policy has been set.
public boolean	Returns: true if AEs is used isAES() True if AES is used for encryption and decryption.
public boolean	Returns: True if meta data has to be decrypted. isDecryptMetadata() Returns true if meta data is to be decrypted.
private boolean	prepareAESInitializationVector(boolean decrypt, byte[] iv, InputStream data, OutputStream output)
public abstract void	prepareDocumentForEncryption(PDDocument The document that will be encrypted. doc) Prepare the document for encryption.
public abstract void	prepareForDecryption(PDEncryption encryption dictionary, can be retrieved via `PDDocument#getEncryption()` encryption, COSArray document id which is returned via `org.apache.pdfbox.cos.COSDocument#getDocumentID()` documentIDArray, DecryptionMaterial Information used to decrypt the document. decryptionMaterial) Prepares everything to decrypt the document.
public void	setAES(boolean if true AES will be used aesValue) Set to true if AES for encryption and decryption should be used.
public void	setCurrentAccessPermission(AccessPermission The access permissions to be set. currentAccessPermission) Sets the access permissions.
public void	setCustomSecureRandom(SecureRandom the custom SecureRandom for AES encryption customSecureRandom) Set the custom SecureRandom.
protected void	setDecryptMetadata(boolean true if meta data has to be decrypted. decryptMetadata) Set whether to decrypt meta data.
public void	setEncryptionKey(byte[] The encryption key data to set. encryptionKey) Sets the current encryption key data.
public void	setKeyLength(int The keyLength to set in bits. keyLen) Setter of the property keyLength.
protected void	setProtectionPolicy(T_POLICY The `ProtectionPolicy`, that shall be set. protectionPolicy) Sets the `ProtectionPolicy` to the given value.
protected void	setStreamFilterName(COSName the stream filter name. streamFilterName) Set the stream filter name.
protected void	setStringFilterName(COSName the string filter name. stringFilterName) Set the string filter name.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

AES_SALT	back to summary
private static final byte[] AES_SALT

currentAccessPermission	back to summary
private AccessPermission currentAccessPermission The access permission granted to the current user for the document. These permissions are computed during decryption and are in read only mode.

customSecureRandom	back to summary
private SecureRandom customSecureRandom Can be used to allow stateless AES encryption

DEFAULT_KEY_LENGTH	back to summary
private static final short DEFAULT_KEY_LENGTH

encryptionKey	back to summary
private byte[] encryptionKey The encryption key that will be used to encrypt / decrypt.

keyLength	back to summary
private short keyLength The length in bits of the secret key used to encrypt the document.

LOG	back to summary
private static final Log LOG

objects	back to summary
private final Set<COSBase> objects

protectionPolicy	back to summary
private T_POLICY protectionPolicy The typed `ProtectionPolicy` to be used for encryption.

rc4	back to summary
private final RC4Cipher rc4 The RC4 implementation used for cryptographic functions.

streamFilterName	back to summary
private COSName streamFilterName The stream filter name.

stringFilterName	back to summary
private COSName stringFilterName The string filter name.

useAES	back to summary
private boolean useAES

SecurityHandler	back to summary
protected SecurityHandler() Constructor.

SecurityHandler	back to summary
protected SecurityHandler(T_POLICY protectionPolicy) Constructor used for encryption. Parameters protectionPolicy:T_POLICY The protection policy.

Method Detail

calcFinalKey	back to summary
private byte[] calcFinalKey(long objectNumber, long genNumber) Calculate the key to be used for RC4 and AES-128. Parameters objectNumber:long The data object number. genNumber:long The data generation number. Returns:byte[] the calculated key.

calcFinalKey

back to summary

private byte[] calcFinalKey(long objectNumber, long genNumber)

Calculate the key to be used for RC4 and AES-128.

Parameters

objectNumber:long: The data object number.
genNumber:long: The data generation number.

Returns:byte[]

the calculated key.

computeVersionNumber back to summary

computeVersionNumber	back to summary
protected int computeVersionNumber() Computes the version number of the `SecurityHandler` based on the encryption key length. See PDF Spec 1.6 p 93 and PDF 1.7 Supplement ExtensionLevel: 3 and PDF Spec 2.0. Returns:int The computed version number.

protected int computeVersionNumber()

Computes the version number of the SecurityHandler based on the encryption key length. See PDF Spec 1.6 p 93 and PDF 1.7 Supplement ExtensionLevel: 3 and PDF Spec 2.0.

Returns:int: The computed version number.

createCipher	back to summary
private Cipher createCipher(byte[] key, byte[] iv, boolean decrypt) throws GeneralSecurityException

decrypt	back to summary
public void decrypt(COSBase obj, long objNum, long genNum) throws IOException This will dispatch to the correct method. Parameters obj:COSBase The object to decrypt. objNum:long The object number. genNum:long The object generation Number. Exceptions IOException: If there is an error getting the stream data.

decrypt

back to summary

public void decrypt(COSBase obj, long objNum, long genNum) throws IOException

This will dispatch to the correct method.

Parameters

obj:COSBase: The object to decrypt.
objNum:long: The object number.
genNum:long: The object generation Number.

Exceptions

IOException:: If there is an error getting the stream data.

decryptArray	back to summary
private void decryptArray(COSArray array, long objNum, long genNum) throws IOException This will decrypt an array. Parameters array:COSArray The array to decrypt. objNum:long The object number. genNum:long The object generation number. Exceptions IOException: If there is an error accessing the data.

decryptArray

back to summary

private void decryptArray(COSArray array, long objNum, long genNum) throws IOException

This will decrypt an array.

Parameters

array:COSArray: The array to decrypt.
objNum:long: The object number.
genNum:long: The object generation number.

Exceptions

IOException:: If there is an error accessing the data.

decryptDictionary	back to summary
private void decryptDictionary(COSDictionary dictionary, long objNum, long genNum) throws IOException This will decrypt a dictionary. Parameters dictionary:COSDictionary The dictionary to decrypt. objNum:long The object number. genNum:long The object generation number. Exceptions IOException: If there is an error creating a new string.

decryptDictionary

back to summary

private void decryptDictionary(COSDictionary dictionary, long objNum, long genNum) throws IOException

This will decrypt a dictionary.

Parameters

dictionary:COSDictionary: The dictionary to decrypt.
objNum:long: The object number.
genNum:long: The object generation number.

Exceptions

IOException:: If there is an error creating a new string.

decryptStream	back to summary
public void decryptStream(COSStream stream, long objNum, long genNum) throws IOException This will decrypt a stream. Parameters stream:COSStream The stream to decrypt. objNum:long The object number. genNum:long The object generation number. Exceptions IOException: If there is an error getting the stream data.

decryptStream

back to summary

public void decryptStream(COSStream stream, long objNum, long genNum) throws IOException

This will decrypt a stream.

Parameters

stream:COSStream: The stream to decrypt.
objNum:long: The object number.
genNum:long: The object generation number.

Exceptions

IOException:: If there is an error getting the stream data.

decryptString	back to summary
private void decryptString(COSString string, long objNum, long genNum) This will decrypt a string. Parameters string:COSString the string to decrypt. objNum:long The object number. genNum:long The object generation number.

decryptString

back to summary

private void decryptString(COSString string, long objNum, long genNum)

This will decrypt a string.

Parameters

string:COSString: the string to decrypt.
objNum:long: The object number.
genNum:long: The object generation number.

encryptData	back to summary
private void encryptData(long objectNumber, long genNumber, InputStream data, OutputStream output, boolean decrypt) throws IOException Encrypt or decrypt a set of data. Parameters objectNumber:long The data object number. genNumber:long The data generation number. data:InputStream The data to encrypt. output:OutputStream The output to write the encrypted data to. decrypt:boolean true to decrypt the data, false to encrypt it. Exceptions IOException: If there is an error reading the data.

encryptData

back to summary

private void encryptData(long objectNumber, long genNumber, InputStream data, OutputStream output, boolean decrypt) throws IOException

Encrypt or decrypt a set of data.

Parameters

objectNumber:long: The data object number.
genNumber:long: The data generation number.
data:InputStream: The data to encrypt.
output:OutputStream: The output to write the encrypted data to.
decrypt:boolean: true to decrypt the data, false to encrypt it.

Exceptions

IOException:: If there is an error reading the data.

encryptDataAES256	back to summary
private void encryptDataAES256(InputStream data, OutputStream output, boolean decrypt) throws IOException Encrypt or decrypt data with AES256. Parameters data:InputStream The data to encrypt. output:OutputStream The output to write the encrypted data to. decrypt:boolean true to decrypt the data, false to encrypt it. Exceptions IOException: If there is an error reading the data.

encryptDataAES256

back to summary

private void encryptDataAES256(InputStream data, OutputStream output, boolean decrypt) throws IOException

Encrypt or decrypt data with AES256.

Parameters

data:InputStream: The data to encrypt.
output:OutputStream: The output to write the encrypted data to.
decrypt:boolean: true to decrypt the data, false to encrypt it.

Exceptions

IOException:: If there is an error reading the data.

encryptDataAESother back to summary

encryptDataAESother	back to summary
private void encryptDataAESother(byte[] finalKey, InputStream data, OutputStream output, boolean decrypt) throws IOException Encrypt or decrypt data with AES with key length other than 256 bits. Parameters finalKey:byte[] The final key obtained with via `calcFinalKey(long, long)`. data:InputStream The data to encrypt. output:OutputStream The output to write the encrypted data to. decrypt:boolean true to decrypt the data, false to encrypt it. Exceptions IOException: If there is an error reading the data.

private void encryptDataAESother(byte[] finalKey, InputStream data, OutputStream output, boolean decrypt) throws IOException

Encrypt or decrypt data with AES with key length other than 256 bits.

Parameters

finalKey:byte[]: The final key obtained with via calcFinalKey(long, long).
data:InputStream: The data to encrypt.
output:OutputStream: The output to write the encrypted data to.
decrypt:boolean: true to decrypt the data, false to encrypt it.

Exceptions

IOException:: If there is an error reading the data.

encryptDataRC4 back to summary

encryptDataRC4	back to summary
protected void encryptDataRC4(byte[] finalKey, InputStream input, OutputStream output) throws IOException Encrypt or decrypt data with RC4. Parameters finalKey:byte[] The final key obtained with via `calcFinalKey(long, long)`. input:InputStream The data to encrypt. output:OutputStream The output to write the encrypted data to. Exceptions IOException: If there is an error reading the data.

protected void encryptDataRC4(byte[] finalKey, InputStream input, OutputStream output) throws IOException

Encrypt or decrypt data with RC4.

Parameters

finalKey:byte[]: The final key obtained with via calcFinalKey(long, long).
input:InputStream: The data to encrypt.
output:OutputStream: The output to write the encrypted data to.

Exceptions

IOException:: If there is an error reading the data.

encryptDataRC4 back to summary

encryptDataRC4	back to summary
protected void encryptDataRC4(byte[] finalKey, byte[] input, OutputStream output) throws IOException Encrypt or decrypt data with RC4. Parameters finalKey:byte[] The final key obtained with via `calcFinalKey(long, long)`. input:byte[] The data to encrypt. output:OutputStream The output to write the encrypted data to. Exceptions IOException: If there is an error reading the data.

protected void encryptDataRC4(byte[] finalKey, byte[] input, OutputStream output) throws IOException

Encrypt or decrypt data with RC4.

Parameters

finalKey:byte[]: The final key obtained with via calcFinalKey(long, long).
input:byte[]: The data to encrypt.
output:OutputStream: The output to write the encrypted data to.

Exceptions

IOException:: If there is an error reading the data.

encryptStream	back to summary
public void encryptStream(COSStream stream, long objNum, int genNum) throws IOException This will encrypt a stream, but not the dictionary as the dictionary is encrypted by visitFromString() in COSWriter and we don't want to encrypt it twice. Parameters stream:COSStream The stream to decrypt. objNum:long The object number. genNum:int The object generation number. Exceptions IOException: If there is an error getting the stream data.

encryptStream

back to summary

public void encryptStream(COSStream stream, long objNum, int genNum) throws IOException

This will encrypt a stream, but not the dictionary as the dictionary is encrypted by visitFromString() in COSWriter and we don't want to encrypt it twice.

Parameters

stream:COSStream: The stream to decrypt.
objNum:long: The object number.
genNum:int: The object generation number.

Exceptions

IOException:: If there is an error getting the stream data.

encryptString	back to summary
public void encryptString(COSString string, long objNum, int genNum) throws IOException This will encrypt a string. Parameters string:COSString the string to encrypt. objNum:long The object number. genNum:int The object generation number. Exceptions IOException: If an error occurs writing the new string.

encryptString

back to summary

public void encryptString(COSString string, long objNum, int genNum) throws IOException

This will encrypt a string.

Parameters

string:COSString: the string to encrypt.
objNum:long: The object number.
genNum:int: The object generation number.

Exceptions

IOException:: If an error occurs writing the new string.

getCurrentAccessPermission	back to summary
public AccessPermission getCurrentAccessPermission() Returns the access permissions that were computed during document decryption. The returned object is in read only mode. Returns:AccessPermission the access permissions or null if the document was not decrypted.

getCurrentAccessPermission

back to summary

public AccessPermission getCurrentAccessPermission()

Returns the access permissions that were computed during document decryption. The returned object is in read only mode.

Returns:AccessPermission: the access permissions or null if the document was not decrypted.

getEncryptionKey	back to summary
public byte[] getEncryptionKey() Returns the current encryption key data. Returns:byte[] The current encryption key data.

getEncryptionKey

back to summary

public byte[] getEncryptionKey()

Returns the current encryption key data.

Returns:byte[]: The current encryption key data.

getKeyLength	back to summary
public int getKeyLength() Getter of the property keyLength. Returns:int Returns the keyLength in bits.

getKeyLength

back to summary

public int getKeyLength()

Getter of the property keyLength.

Returns:int: Returns the keyLength in bits.

getProtectionPolicy back to summary

getProtectionPolicy	back to summary
protected T_POLICY getProtectionPolicy() Returns the set `ProtectionPolicy` or null. Returns:T_POLICY The set `ProtectionPolicy`.

protected T_POLICY getProtectionPolicy()

Returns the set ProtectionPolicy or null.

Returns:T_POLICY: The set ProtectionPolicy.

getSecureRandom	back to summary
private SecureRandom getSecureRandom() Returns a SecureRandom If customSecureRandom is not defined, instantiate a new SecureRandom Returns:SecureRandom SecureRandom

getSecureRandom

back to summary

private SecureRandom getSecureRandom()

Returns a SecureRandom If customSecureRandom is not defined, instantiate a new SecureRandom

Returns:SecureRandom: SecureRandom

hasProtectionPolicy	back to summary
public boolean hasProtectionPolicy() Returns whether a protection policy has been set. Returns:boolean true if a protection policy has been set.

hasProtectionPolicy

back to summary

public boolean hasProtectionPolicy()

Returns whether a protection policy has been set.

Returns:boolean: true if a protection policy has been set.

isAES	back to summary
public boolean isAES() True if AES is used for encryption and decryption. Returns:boolean true if AEs is used

isAES

back to summary

public boolean isAES()

True if AES is used for encryption and decryption.

Returns:boolean: true if AEs is used

isDecryptMetadata

back to summary

public boolean isDecryptMetadata()

Returns true if meta data is to be decrypted.

Returns:boolean: True if meta data has to be decrypted.

prepareAESInitializationVector	back to summary
private boolean prepareAESInitializationVector(boolean decrypt, byte[] iv, InputStream data, OutputStream output) throws IOException

prepareDocumentForEncryption	back to summary
public abstract void prepareDocumentForEncryption(PDDocument doc) throws IOException Prepare the document for encryption. Parameters doc:PDDocument The document that will be encrypted. Exceptions IOException: If there is an error with the document.

prepareDocumentForEncryption

back to summary

public abstract void prepareDocumentForEncryption(PDDocument doc) throws IOException

Prepare the document for encryption.

Parameters

doc:PDDocument: The document that will be encrypted.

Exceptions

IOException:: If there is an error with the document.

prepareForDecryption back to summary

prepareForDecryption	back to summary
public abstract void prepareForDecryption(PDEncryption encryption, COSArray documentIDArray, DecryptionMaterial decryptionMaterial) throws IOException Prepares everything to decrypt the document. Parameters encryption:PDEncryption encryption dictionary, can be retrieved via `PDDocument#getEncryption()` documentIDArray:COSArray document id which is returned via `org.apache.pdfbox.cos.COSDocument#getDocumentID()` decryptionMaterial:DecryptionMaterial Information used to decrypt the document. Exceptions IOException: If there is an error accessing data. InvalidPasswordException: If the password is incorrect.

public abstract void prepareForDecryption(PDEncryption encryption, COSArray documentIDArray, DecryptionMaterial decryptionMaterial) throws IOException

Prepares everything to decrypt the document.

Parameters

encryption:PDEncryption: encryption dictionary, can be retrieved via PDDocument#getEncryption()
documentIDArray:COSArray: document id which is returned via org.apache.pdfbox.cos.COSDocument#getDocumentID()
decryptionMaterial:DecryptionMaterial: Information used to decrypt the document.

Exceptions

IOException:: If there is an error accessing data.
InvalidPasswordException:: If the password is incorrect.

setAES	back to summary
public void setAES(boolean aesValue) Set to true if AES for encryption and decryption should be used. Parameters aesValue:boolean if true AES will be used

setAES

back to summary

public void setAES(boolean aesValue)

Set to true if AES for encryption and decryption should be used.

Parameters

aesValue:boolean: if true AES will be used

setCurrentAccessPermission	back to summary
public void setCurrentAccessPermission(AccessPermission currentAccessPermission) Sets the access permissions. Parameters currentAccessPermission:AccessPermission The access permissions to be set.

setCurrentAccessPermission

back to summary

public void setCurrentAccessPermission(AccessPermission currentAccessPermission)

Sets the access permissions.

Parameters

currentAccessPermission:AccessPermission: The access permissions to be set.

setCustomSecureRandom	back to summary
public void setCustomSecureRandom(SecureRandom customSecureRandom) Set the custom SecureRandom. Parameters customSecureRandom:SecureRandom the custom SecureRandom for AES encryption

setCustomSecureRandom

back to summary

public void setCustomSecureRandom(SecureRandom customSecureRandom)

Set the custom SecureRandom.

Parameters

customSecureRandom:SecureRandom: the custom SecureRandom for AES encryption

setDecryptMetadata

back to summary

protected void setDecryptMetadata(boolean decryptMetadata)

Set whether to decrypt meta data.

Parameters

decryptMetadata:boolean: true if meta data has to be decrypted.

setEncryptionKey	back to summary
public void setEncryptionKey(byte[] encryptionKey) Sets the current encryption key data. Parameters encryptionKey:byte[] The encryption key data to set.

setEncryptionKey

back to summary

public void setEncryptionKey(byte[] encryptionKey)

Sets the current encryption key data.

Parameters

encryptionKey:byte[]: The encryption key data to set.

setKeyLength

back to summary

public void setKeyLength(int keyLen)

Setter of the property keyLength.

Parameters

keyLen:int: The keyLength to set in bits.

setProtectionPolicy back to summary

protected void setProtectionPolicy(T_POLICY protectionPolicy)

Sets the ProtectionPolicy to the given value.

Parameters

protectionPolicy:T_POLICY: The ProtectionPolicy, that shall be set.

setStreamFilterName

back to summary

protected void setStreamFilterName(COSName streamFilterName)

Set the stream filter name.

Parameters

streamFilterName:COSName: the stream filter name.

setStringFilterName

back to summary

protected void setStringFilterName(COSName stringFilterName)

Set the string filter name.

Parameters

stringFilterName:COSName: the string filter name.

public abstract Class SecurityHandler<T_POLICY extends ProtectionPolicy>

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail