Top Description Fields Constructors Methods
org.apache.pdfbox.pdmodel.encryption

public final Class StandardSecurityHandler

extends SecurityHandler<StandardProtectionPolicy>
Class Inheritance
Imports
java.io.ByteArrayInputStream, .ByteArrayOutputStream, .IOException, java.math.BigInteger, java.nio.charset.Charset, .StandardCharsets, java.security.GeneralSecurityException, .MessageDigest, .NoSuchAlgorithmException, .SecureRandom, java.util.Arrays, javax.crypto.Cipher, javax.crypto.spec.IvParameterSpec, .SecretKeySpec, org.apache.commons.logging.Log, .LogFactory, org.apache.pdfbox.cos.COSArray, .COSName, .COSString, org.apache.pdfbox.pdmodel.PDDocument
The standard security handler. This security handler protects document with password.
Authors
Ben Litchfield, Benoit Guillon, Manuel Kasper
See Also
to see how to protect document with this security handler.

Field Summary

Modifier and TypeField and Description
private static final byte[]
ENCRYPT_PADDING

Standard padding for encryption.

public static final String
FILTER

Type of security handler.

private static final String[]
HASHES_2B

private static final Log
LOG

Hides org.apache.pdfbox.pdmodel.encryption.SecurityHandler.LOG.

Log instance.
public static final Class<?>
PROTECTION_POLICY_CLASS

Protection policy class for this handler.

private static final int
REVISION_2

private static final int
REVISION_3

private static final int
REVISION_4

private static final int
REVISION_5

private static final int
REVISION_6

Constructor Summary

AccessConstructor and Description
public
StandardSecurityHandler()

Constructor.

public
StandardSecurityHandler(StandardProtectionPolicy
The protection policy.
standardProtectionPolicy)

Constructor used for encryption.

Method Summary

Modifier and TypeMethod and Description
private static byte[]
adjustUserKey(byte[] u)

public byte[]

Returns:

The encrypted key bytes.
computeEncryptedKey(byte[]
The password to compute the encrypted key.
password, byte[]
The O entry of the encryption dictionary.
o, byte[]
The U entry of the encryption dictionary.
u, byte[]
The OE entry of the encryption dictionary.
oe, byte[]
The UE entry of the encryption dictionary.
ue, int
The permissions for the document.
permissions, byte[]
The document id.
id, int
The revision of the encryption algorithm.
encRevision, int
The length of the encryption key in bytes.
keyLengthInBytes, boolean
The encryption metadata
encryptMetadata, boolean
whether the password given is the owner password (for revision 6)
isOwnerPassword)

Compute the encryption key.

private byte[]
computeEncryptedKeyRev234(byte[] password, byte[] o, int permissions, byte[] id, boolean encryptMetadata, int length, int encRevision)

private byte[]
computeEncryptedKeyRev56(byte[] password, boolean isOwnerPassword, byte[] o, byte[] u, byte[] oe, byte[] ue, int encRevision)

private byte[]
computeHash2A(byte[] password, byte[] salt, byte[] u)

private static byte[]
computeHash2B(byte[] input, byte[] password, byte[] userKey)

public byte[]

Returns:

The o entry of the encryption dictionary.
computeOwnerPassword(byte[]
The plaintext owner password.
ownerPassword, byte[]
The plaintext user password.
userPassword, int
The revision number of the encryption algorithm.
encRevision, int
The length of the encryption key.
length)

Compute the owner entry in the encryption dictionary.

private byte[]
computeRC4key(byte[] ownerPassword, int encRevision, int length)

private int

Returns:

The computed revision number.
computeRevisionNumber(int
The version number.
version)

Computes the revision version of the StandardSecurityHandler to use regarding the version number and the permissions bits set.

private static byte[]
computeSHA256(byte[] input, byte[] password, byte[] userKey)

public byte[]

Returns:

The user password.
computeUserPassword(byte[]
The plain text password.
password, byte[]
The owner password hash.
owner, int
The document permissions.
permissions, byte[]
The document id.
id, int
The revision of the encryption.
encRevision, int
The length of the encryption key in bytes.
keyLengthInBytes, boolean
The encryption metadata
encryptMetadata)

This will compute the user password hash.

private static byte[]
concat(byte[] a, byte[] b)

private static byte[]
concat(byte[] a, byte[] b, byte[] c)

private byte[]
getDocumentIDBytes(COSArray documentIDArray)

public byte[]

Returns:

The u entry of the encryption dictionary.
getUserPassword(byte[]
The plaintext owner password.
ownerPassword, byte[]
The o entry of the encryption dictionary.
owner, int
The encryption revision number.
encRevision, int
The key length.
length)

Get the user password based on the owner password.

private byte[]
getUserPassword234(byte[] ownerPassword, byte[] owner, int encRevision, int length)

public boolean

Returns:

True If the ownerPassword param is the owner password.
isOwnerPassword(byte[]
The owner password.
ownerPassword, byte[]
The u entry of the encryption dictionary.
user, byte[]
The o entry of the encryption dictionary.
owner, int
The set of permissions on the document.
permissions, byte[]
The document id.
id, int
The encryption algorithm revision.
encRevision, int
The encryption key length in bytes.
keyLengthInBytes, boolean
The encryption metadata
encryptMetadata)

Check for owner password.

public boolean

Returns:

True If the ownerPassword param is the owner password.
isOwnerPassword(String
The owner password.
password, byte[]
The u entry of the encryption dictionary.
user, byte[]
The o entry of the encryption dictionary.
owner, int
The set of permissions on the document.
permissions, byte[]
The document id.
id, int
The encryption algorithm revision.
encRevision, int
The encryption key length in bytes.
keyLengthInBytes, boolean
The encryption metadata
encryptMetadata)

Check for owner password.

private boolean
isOwnerPassword234(byte[] ownerPassword, byte[] user, byte[] owner, int permissions, byte[] id, int encRevision, int keyLengthInBytes, boolean encryptMetadata)

private boolean
isOwnerPassword56(byte[] ownerPassword, byte[] user, byte[] owner, int encRevision)

public boolean

Returns:

true If the plaintext password is the user password.
isUserPassword(byte[]
The plaintext password.
password, byte[]
The u entry of the encryption dictionary.
user, byte[]
The o entry of the encryption dictionary.
owner, int
The permissions set in the PDF.
permissions, byte[]
The document id used for encryption.
id, int
The revision of the encryption algorithm.
encRevision, int
The length of the encryption key in bytes.
keyLengthInBytes, boolean
The encryption metadata.
encryptMetadata)

Check if a plaintext password is the user password.

public boolean

Returns:

true If the plaintext password is the user password.
isUserPassword(String
The plaintext password.
password, byte[]
The u entry of the encryption dictionary.
user, byte[]
The o entry of the encryption dictionary.
owner, int
The permissions set in the PDF.
permissions, byte[]
The document id used for encryption.
id, int
The revision of the encryption algorithm.
encRevision, int
The length of the encryption key in bytes.
keyLengthInBytes, boolean
The encryption metadata
encryptMetadata)

Check if a plaintext password is the user password.

private boolean
isUserPassword234(byte[] password, byte[] user, byte[] owner, int permissions, byte[] id, int encRevision, int length, boolean encryptMetadata)

private boolean
isUserPassword56(byte[] password, byte[] user, int encRevision)

private static void
logIfStrongEncryptionMissing()

public void
prepareDocumentForEncryption(PDDocument
The document to encrypt.
document)

Implements abstract org.apache.pdfbox.pdmodel.encryption.SecurityHandler.prepareDocumentForEncryption.

Prepare document for encryption.

private void
prepareEncryptionDictAES(PDEncryption encryptionDictionary, COSName aesVName)

private void
prepareEncryptionDictRev234(String ownerPassword, String userPassword, PDEncryption encryptionDictionary, int permissionInt, PDDocument document, int revision, int length)

private void
prepareEncryptionDictRev6(String ownerPassword, String userPassword, PDEncryption encryptionDictionary, int permissionInt)

public void
prepareForDecryption(PDEncryption
encryption dictionary
encryption, COSArray
document id
documentIDArray, DecryptionMaterial
Information used to decrypt the document.
decryptionMaterial)

Implements abstract org.apache.pdfbox.pdmodel.encryption.SecurityHandler.prepareForDecryption.

Prepares everything to decrypt the document.

private static byte[]
truncate127(byte[] in)

private byte[]

Returns:

The padded or truncated password.
truncateOrPad(byte[]
The password to pad or truncate.
password)

This will take the password and truncate or pad it as necessary.

private void
validatePerms(PDEncryption encryption, int dicPermissions, boolean encryptMetadata)

Inherited from org.apache.pdfbox.pdmodel.encryption.SecurityHandler:
computeVersionNumberdecryptdecryptStreamencryptDataRC4encryptDataRC4encryptStreamencryptStringgetCurrentAccessPermissiongetEncryptionKeygetKeyLengthgetProtectionPolicyhasProtectionPolicyisAESisDecryptMetadatasetAESsetCurrentAccessPermissionsetCustomSecureRandomsetDecryptMetadatasetEncryptionKeysetKeyLengthsetProtectionPolicysetStreamFilterNamesetStringFilterName

Field Detail

ENCRYPT_PADDINGback to summary
private static final byte[] ENCRYPT_PADDING

Standard padding for encryption.

FILTERback to summary
public static final String FILTER

Type of security handler.

HASHES_2Bback to summary
private static final String[] HASHES_2B
LOGback to summary
private static final Log LOG

Hides org.apache.pdfbox.pdmodel.encryption.SecurityHandler.LOG.

Log instance.

PROTECTION_POLICY_CLASSback to summary
public static final Class<?> PROTECTION_POLICY_CLASS

Protection policy class for this handler.

REVISION_2back to summary
private static final int REVISION_2
REVISION_3back to summary
private static final int REVISION_3
REVISION_4back to summary
private static final int REVISION_4
REVISION_5back to summary
private static final int REVISION_5
REVISION_6back to summary
private static final int REVISION_6

Constructor Detail

StandardSecurityHandlerback to summary
public StandardSecurityHandler()

Constructor.

StandardSecurityHandlerback to summary
public StandardSecurityHandler(StandardProtectionPolicy standardProtectionPolicy)

Constructor used for encryption.

Parameters
standardProtectionPolicy:StandardProtectionPolicy

The protection policy.

Method Detail

adjustUserKeyback to summary
private static byte[] adjustUserKey(byte[] u) throws IOException
computeEncryptedKeyback to summary
public byte[] computeEncryptedKey(byte[] password, byte[] o, byte[] u, byte[] oe, byte[] ue, int permissions, byte[] id, int encRevision, int keyLengthInBytes, boolean encryptMetadata, boolean isOwnerPassword) throws IOException

Compute the encryption key.

Parameters
password:byte[]

The password to compute the encrypted key.

o:byte[]

The O entry of the encryption dictionary.

u:byte[]

The U entry of the encryption dictionary.

oe:byte[]

The OE entry of the encryption dictionary.

ue:byte[]

The UE entry of the encryption dictionary.

permissions:int

The permissions for the document.

id:byte[]

The document id.

encRevision:int

The revision of the encryption algorithm.

keyLengthInBytes:int

The length of the encryption key in bytes.

encryptMetadata:boolean

The encryption metadata

isOwnerPassword:boolean

whether the password given is the owner password (for revision 6)

Returns:byte[]

The encrypted key bytes.

Exceptions
IOException:
If there is an error with encryption.
computeEncryptedKeyRev234back to summary
private byte[] computeEncryptedKeyRev234(byte[] password, byte[] o, int permissions, byte[] id, boolean encryptMetadata, int length, int encRevision)
computeEncryptedKeyRev56back to summary
private byte[] computeEncryptedKeyRev56(byte[] password, boolean isOwnerPassword, byte[] o, byte[] u, byte[] oe, byte[] ue, int encRevision) throws IOException
computeHash2Aback to summary
private byte[] computeHash2A(byte[] password, byte[] salt, byte[] u) throws IOException
computeHash2Bback to summary
private static byte[] computeHash2B(byte[] input, byte[] password, byte[] userKey) throws IOException
computeOwnerPasswordback to summary
public byte[] computeOwnerPassword(byte[] ownerPassword, byte[] userPassword, int encRevision, int length) throws IOException

Compute the owner entry in the encryption dictionary.

Parameters
ownerPassword:byte[]

The plaintext owner password.

userPassword:byte[]

The plaintext user password.

encRevision:int

The revision number of the encryption algorithm.

length:int

The length of the encryption key.

Returns:byte[]

The o entry of the encryption dictionary.

Exceptions
IOException:
if the owner password could not be computed
computeRC4keyback to summary
private byte[] computeRC4key(byte[] ownerPassword, int encRevision, int length)
computeRevisionNumberback to summary
private int computeRevisionNumber(int version)

Computes the revision version of the StandardSecurityHandler to use regarding the version number and the permissions bits set. See PDF Spec 1.6 p98

Parameters
version:int

The version number.

Returns:int

The computed revision number.

computeSHA256back to summary
private static byte[] computeSHA256(byte[] input, byte[] password, byte[] userKey) throws IOException
computeUserPasswordback to summary
public byte[] computeUserPassword(byte[] password, byte[] owner, int permissions, byte[] id, int encRevision, int keyLengthInBytes, boolean encryptMetadata) throws IOException

This will compute the user password hash.

Parameters
password:byte[]

The plain text password.

owner:byte[]

The owner password hash.

permissions:int

The document permissions.

id:byte[]

The document id.

encRevision:int

The revision of the encryption.

keyLengthInBytes:int

The length of the encryption key in bytes.

encryptMetadata:boolean

The encryption metadata

Returns:byte[]

The user password.

Exceptions
IOException:
if the password could not be computed
concatback to summary
private static byte[] concat(byte[] a, byte[] b)
concatback to summary
private static byte[] concat(byte[] a, byte[] b, byte[] c)
getDocumentIDBytesback to summary
private byte[] getDocumentIDBytes(COSArray documentIDArray)
getUserPasswordback to summary
public byte[] getUserPassword(byte[] ownerPassword, byte[] owner, int encRevision, int length) throws IOException

Get the user password based on the owner password.

Parameters
ownerPassword:byte[]

The plaintext owner password.

owner:byte[]

The o entry of the encryption dictionary.

encRevision:int

The encryption revision number.

length:int

The key length.

Returns:byte[]

The u entry of the encryption dictionary.

Exceptions
IOException:
If there is an error accessing data while generating the user password.
getUserPassword234back to summary
private byte[] getUserPassword234(byte[] ownerPassword, byte[] owner, int encRevision, int length) throws IOException
isOwnerPasswordback to summary
public boolean isOwnerPassword(byte[] ownerPassword, byte[] user, byte[] owner, int permissions, byte[] id, int encRevision, int keyLengthInBytes, boolean encryptMetadata) throws IOException

Check for owner password.

Parameters
ownerPassword:byte[]

The owner password.

user:byte[]

The u entry of the encryption dictionary.

owner:byte[]

The o entry of the encryption dictionary.

permissions:int

The set of permissions on the document.

id:byte[]

The document id.

encRevision:int

The encryption algorithm revision.

keyLengthInBytes:int

The encryption key length in bytes.

encryptMetadata:boolean

The encryption metadata

Returns:boolean

True If the ownerPassword param is the owner password.

Exceptions
IOException:
If there is an error accessing data.
isOwnerPasswordback to summary
public boolean isOwnerPassword(String password, byte[] user, byte[] owner, int permissions, byte[] id, int encRevision, int keyLengthInBytes, boolean encryptMetadata) throws IOException

Check for owner password.

Parameters
password:String

The owner password.

user:byte[]

The u entry of the encryption dictionary.

owner:byte[]

The o entry of the encryption dictionary.

permissions:int

The set of permissions on the document.

id:byte[]

The document id.

encRevision:int

The encryption algorithm revision.

keyLengthInBytes:int

The encryption key length in bytes.

encryptMetadata:boolean

The encryption metadata

Returns:boolean

True If the ownerPassword param is the owner password.

Exceptions
IOException:
If there is an error accessing data.
isOwnerPassword234back to summary
private boolean isOwnerPassword234(byte[] ownerPassword, byte[] user, byte[] owner, int permissions, byte[] id, int encRevision, int keyLengthInBytes, boolean encryptMetadata) throws IOException
isOwnerPassword56back to summary
private boolean isOwnerPassword56(byte[] ownerPassword, byte[] user, byte[] owner, int encRevision) throws IOException
isUserPasswordback to summary
public boolean isUserPassword(byte[] password, byte[] user, byte[] owner, int permissions, byte[] id, int encRevision, int keyLengthInBytes, boolean encryptMetadata) throws IOException

Check if a plaintext password is the user password.

Parameters
password:byte[]

The plaintext password.

user:byte[]

The u entry of the encryption dictionary.

owner:byte[]

The o entry of the encryption dictionary.

permissions:int

The permissions set in the PDF.

id:byte[]

The document id used for encryption.

encRevision:int

The revision of the encryption algorithm.

keyLengthInBytes:int

The length of the encryption key in bytes.

encryptMetadata:boolean

The encryption metadata.

Returns:boolean

true If the plaintext password is the user password.

Exceptions
IOException:
If there is an error accessing data.
isUserPasswordback to summary
public boolean isUserPassword(String password, byte[] user, byte[] owner, int permissions, byte[] id, int encRevision, int keyLengthInBytes, boolean encryptMetadata) throws IOException

Check if a plaintext password is the user password.

Parameters
password:String

The plaintext password.

user:byte[]

The u entry of the encryption dictionary.

owner:byte[]

The o entry of the encryption dictionary.

permissions:int

The permissions set in the PDF.

id:byte[]

The document id used for encryption.

encRevision:int

The revision of the encryption algorithm.

keyLengthInBytes:int

The length of the encryption key in bytes.

encryptMetadata:boolean

The encryption metadata

Returns:boolean

true If the plaintext password is the user password.

Exceptions
IOException:
If there is an error accessing data.
isUserPassword234back to summary
private boolean isUserPassword234(byte[] password, byte[] user, byte[] owner, int permissions, byte[] id, int encRevision, int length, boolean encryptMetadata) throws IOException
isUserPassword56back to summary
private boolean isUserPassword56(byte[] password, byte[] user, int encRevision) throws IOException
logIfStrongEncryptionMissingback to summary
private static void logIfStrongEncryptionMissing()
prepareDocumentForEncryptionback to summary
public void prepareDocumentForEncryption(PDDocument document) throws IOException

Implements abstract org.apache.pdfbox.pdmodel.encryption.SecurityHandler.prepareDocumentForEncryption.

Prepare document for encryption.

Parameters
document:PDDocument

The document to encrypt.

Annotations
@Override
Exceptions
IOException:
If there is an error accessing data.
prepareEncryptionDictAESback to summary
private void prepareEncryptionDictAES(PDEncryption encryptionDictionary, COSName aesVName)
prepareEncryptionDictRev234back to summary
private void prepareEncryptionDictRev234(String ownerPassword, String userPassword, PDEncryption encryptionDictionary, int permissionInt, PDDocument document, int revision, int length) throws IOException
prepareEncryptionDictRev6back to summary
private void prepareEncryptionDictRev6(String ownerPassword, String userPassword, PDEncryption encryptionDictionary, int permissionInt) throws IOException
prepareForDecryptionback to summary
public void prepareForDecryption(PDEncryption encryption, COSArray documentIDArray, DecryptionMaterial decryptionMaterial) throws IOException

Implements abstract org.apache.pdfbox.pdmodel.encryption.SecurityHandler.prepareForDecryption.

Prepares everything to decrypt the document. Only if decryption of single objects is needed this should be called.

Parameters
encryption:PDEncryption

encryption dictionary

documentIDArray:COSArray

document id

decryptionMaterial:DecryptionMaterial

Information used to decrypt the document.

Annotations
@Override
Exceptions
IOException:
If there is an error accessing data.
InvalidPasswordException:
If the password is incorrect.
truncate127back to summary
private static byte[] truncate127(byte[] in)
truncateOrPadback to summary
private byte[] truncateOrPad(byte[] password)

This will take the password and truncate or pad it as necessary.

Parameters
password:byte[]

The password to pad or truncate.

Returns:byte[]

The padded or truncated password.

validatePermsback to summary
private void validatePerms(PDEncryption encryption, int dicPermissions, boolean encryptMetadata) throws IOException