Mercurial > hgrepos > Python2 > PyMuPDF

comparison mupdf-source/source/pdf/pdf-crypt.c @ 2:b50eed0cc0ef upstream

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
ADD: MuPDF v1.26.7: the MuPDF source as downloaded by a default build of PyMuPDF 1.26.4. The directory name has changed: no version number in the expanded directory now.
author Franz Glasner <fzglas.hg@dom66.de>
date Mon, 15 Sep 2025 11:43:07 +0200
parents
children
comparison
equal deleted inserted replaced
1:1d09e1dec1d9 2:b50eed0cc0ef
1 // Copyright (C) 2004-2025 Artifex Software, Inc.
2 //
3 // This file is part of MuPDF.
4 //
5 // MuPDF is free software: you can redistribute it and/or modify it under the
6 // terms of the GNU Affero General Public License as published by the Free
7 // Software Foundation, either version 3 of the License, or (at your option)
8 // any later version.
9 //
10 // MuPDF is distributed in the hope that it will be useful, but WITHOUT ANY
11 // WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
12 // FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
13 // details.
14 //
15 // You should have received a copy of the GNU Affero General Public License
16 // along with MuPDF. If not, see <https://www.gnu.org/licenses/agpl-3.0.en.html>
17 //
18 // Alternative licensing terms are available from the licensor.
19 // For commercial licensing, see <https://www.artifex.com/> or contact
20 // Artifex Software, Inc., 39 Mesa Street, Suite 108A, San Francisco,
21 // CA 94129, USA, for further information.
22
23 #include "mupdf/fitz.h"
24 #include "mupdf/pdf.h"
25
26 #include <string.h>
27
28 enum
29 {
30 PDF_CRYPT_NONE,
31 PDF_CRYPT_RC4,
32 PDF_CRYPT_AESV2,
33 PDF_CRYPT_AESV3,
34 PDF_CRYPT_UNKNOWN,
35 };
36
37 typedef struct
38 {
39 int method;
40 int length;
41 } pdf_crypt_filter;
42
43 struct pdf_crypt
44 {
45 pdf_obj *id;
46
47 int v;
48 int length;
49 pdf_obj *cf;
50 pdf_crypt_filter stmf;
51 pdf_crypt_filter strf;
52
53 int r;
54 unsigned char o[48];
55 unsigned char u[48];
56 unsigned char oe[32];
57 unsigned char ue[32];
58 unsigned char perms[16];
59 int p;
60 int encrypt_metadata;
61
62 unsigned char key[32]; /* decryption key generated from password */
63 };
64
65 static void pdf_parse_crypt_filter(fz_context *ctx, pdf_crypt_filter *cf, pdf_crypt *crypt, pdf_obj *name);
66
67 pdf_crypt *
68 pdf_new_crypt(fz_context *ctx, pdf_obj *dict, pdf_obj *id)
69 {
70 pdf_crypt *crypt;
71 pdf_obj *obj;
72
73 crypt = fz_malloc_struct(ctx, pdf_crypt);
74
75 /* Common to all security handlers (PDF 1.7 table 3.18) */
76
77 obj = pdf_dict_get(ctx, dict, PDF_NAME(Filter));
78 if (!pdf_is_name(ctx, obj))
79 {
80 pdf_drop_crypt(ctx, crypt);
81 fz_throw(ctx, FZ_ERROR_FORMAT, "unspecified encryption handler");
82 }
83 if (!pdf_name_eq(ctx, PDF_NAME(Standard), obj))
84 {
85 pdf_drop_crypt(ctx, crypt);
86 fz_throw(ctx, FZ_ERROR_FORMAT, "unknown encryption handler: '%s'", pdf_to_name(ctx, obj));
87 }
88
89 crypt->v = pdf_dict_get_int_default(ctx, dict, PDF_NAME(V), 0);
90 if (crypt->v != 0 && crypt->v != 1 && crypt->v != 2 && crypt->v != 4 && crypt->v != 5)
91 {
92 pdf_drop_crypt(ctx, crypt);
93 fz_throw(ctx, FZ_ERROR_FORMAT, "unknown encryption version");
94 }
95
96 /* Standard security handler (PDF 1.7 table 3.19) */
97
98 obj = pdf_dict_get(ctx, dict, PDF_NAME(R));
99 if (pdf_is_int(ctx, obj))
100 crypt->r = pdf_to_int(ctx, obj);
101 else if (crypt->v <= 4)
102 {
103 fz_warn(ctx, "encryption dictionary missing revision value, guessing...");
104 if (crypt->v < 2)
105 crypt->r = 2;
106 else if (crypt->v == 2)
107 crypt->r = 3;
108 else if (crypt->v == 4)
109 crypt->r = 4;
110 }
111 else
112 {
113 pdf_drop_crypt(ctx, crypt);
114 fz_throw(ctx, FZ_ERROR_FORMAT, "encryption dictionary missing version and revision value");
115 }
116 if (crypt->r < 1 || crypt->r > 6)
117 {
118 int r = crypt->r;
119 pdf_drop_crypt(ctx, crypt);
120 fz_throw(ctx, FZ_ERROR_FORMAT, "unknown crypt revision %d", r);
121 }
122
123 obj = pdf_dict_get(ctx, dict, PDF_NAME(O));
124 if (pdf_is_string(ctx, obj) && pdf_to_str_len(ctx, obj) == 32)
125 memcpy(crypt->o, pdf_to_str_buf(ctx, obj), 32);
126 /* /O and /U are supposed to be 48 bytes long for revision 5 and 6, they're often longer, though */
127 else if (crypt->r >= 5 && pdf_is_string(ctx, obj) && pdf_to_str_len(ctx, obj) >= 48)
128 memcpy(crypt->o, pdf_to_str_buf(ctx, obj), 48);
129 else
130 {
131 pdf_drop_crypt(ctx, crypt);
132 fz_throw(ctx, FZ_ERROR_FORMAT, "encryption dictionary missing owner password");
133 }
134
135 obj = pdf_dict_get(ctx, dict, PDF_NAME(U));
136 if (pdf_is_string(ctx, obj) && pdf_to_str_len(ctx, obj) == 32)
137 memcpy(crypt->u, pdf_to_str_buf(ctx, obj), 32);
138 /* /O and /U are supposed to be 48 bytes long for revision 5 and 6, they're often longer, though */
139 else if (crypt->r >= 5 && pdf_is_string(ctx, obj) && pdf_to_str_len(ctx, obj) >= 48)
140 memcpy(crypt->u, pdf_to_str_buf(ctx, obj), 48);
141 else if (pdf_is_string(ctx, obj) && pdf_to_str_len(ctx, obj) < 32)
142 {
143 fz_warn(ctx, "encryption password key too short (%zu)", pdf_to_str_len(ctx, obj));
144 memcpy(crypt->u, pdf_to_str_buf(ctx, obj), pdf_to_str_len(ctx, obj));
145 }
146 else
147 {
148 pdf_drop_crypt(ctx, crypt);
149 fz_throw(ctx, FZ_ERROR_FORMAT, "encryption dictionary missing user password");
150 }
151
152 obj = pdf_dict_get(ctx, dict, PDF_NAME(P));
153 if (pdf_is_int(ctx, obj))
154 crypt->p = pdf_to_int(ctx, obj);
155 else
156 {
157 fz_warn(ctx, "encryption dictionary missing permissions");
158 crypt->p = 0xfffffffc;
159 }
160
161 if (crypt->r == 5 || crypt->r == 6)
162 {
163 obj = pdf_dict_get(ctx, dict, PDF_NAME(OE));
164 if (!pdf_is_string(ctx, obj) || pdf_to_str_len(ctx, obj) != 32)
165 {
166 pdf_drop_crypt(ctx, crypt);
167 fz_throw(ctx, FZ_ERROR_FORMAT, "encryption dictionary missing owner encryption key");
168 }
169 memcpy(crypt->oe, pdf_to_str_buf(ctx, obj), 32);
170
171 obj = pdf_dict_get(ctx, dict, PDF_NAME(UE));
172 if (!pdf_is_string(ctx, obj) || pdf_to_str_len(ctx, obj) != 32)
173 {
174 pdf_drop_crypt(ctx, crypt);
175 fz_throw(ctx, FZ_ERROR_FORMAT, "encryption dictionary missing user encryption key");
176 }
177 memcpy(crypt->ue, pdf_to_str_buf(ctx, obj), 32);
178 }
179
180 crypt->encrypt_metadata = pdf_dict_get_bool_default(ctx, dict, PDF_NAME(EncryptMetadata), 1);
181
182 /* Extract file identifier string */
183
184 if (pdf_is_array(ctx, id) && pdf_array_len(ctx, id) == 2)
185 {
186 obj = pdf_array_get(ctx, id, 0);
187 if (pdf_is_string(ctx, obj))
188 crypt->id = pdf_keep_obj(ctx, obj);
189 }
190 else
191 fz_warn(ctx, "missing file identifier, may not be able to do decryption");
192
193 /* Determine encryption key length */
194
195 crypt->length = 40;
196 if (crypt->v == 2 || crypt->v == 4)
197 {
198 crypt->length = pdf_dict_get_int_default(ctx, dict, PDF_NAME(Length), crypt->length);
199
200 /* work-around for pdf generators that assume length is in bytes */
201 if (crypt->length < 40)
202 crypt->length = crypt->length * 8;
203
204 if (crypt->length % 8 != 0)
205 {
206 pdf_drop_crypt(ctx, crypt);
207 fz_throw(ctx, FZ_ERROR_FORMAT, "invalid encryption key length");
208 }
209 if (crypt->length < 40 || crypt->length > 128)
210 {
211 pdf_drop_crypt(ctx, crypt);
212 fz_throw(ctx, FZ_ERROR_FORMAT, "invalid encryption key length");
213 }
214 }
215
216 if (crypt->v == 5)
217 crypt->length = 256;
218
219 if (crypt->v == 0 || crypt->v == 1 || crypt->v == 2)
220 {
221 crypt->stmf.method = PDF_CRYPT_RC4;
222 crypt->stmf.length = crypt->length;
223
224 crypt->strf.method = PDF_CRYPT_RC4;
225 crypt->strf.length = crypt->length;
226 }
227
228 if (crypt->v == 4 || crypt->v == 5)
229 {
230 crypt->stmf.method = PDF_CRYPT_NONE;
231 crypt->stmf.length = crypt->length;
232
233 crypt->strf.method = PDF_CRYPT_NONE;
234 crypt->strf.length = crypt->length;
235
236 obj = pdf_dict_get(ctx, dict, PDF_NAME(CF));
237 if (pdf_is_dict(ctx, obj))
238 {
239 crypt->cf = pdf_keep_obj(ctx, obj);
240 }
241 else
242 {
243 crypt->cf = NULL;
244 }
245
246 fz_try(ctx)
247 {
248 obj = pdf_dict_get(ctx, dict, PDF_NAME(StmF));
249 if (pdf_is_name(ctx, obj))
250 pdf_parse_crypt_filter(ctx, &crypt->stmf, crypt, obj);
251
252 obj = pdf_dict_get(ctx, dict, PDF_NAME(StrF));
253 if (pdf_is_name(ctx, obj))
254 pdf_parse_crypt_filter(ctx, &crypt->strf, crypt, obj);
255 }
256 fz_catch(ctx)
257 {
258 pdf_drop_crypt(ctx, crypt);
259 fz_rethrow(ctx);
260 }
261
262 /* in crypt revision 4, the crypt filter determines the key length */
263 if (crypt->strf.method != PDF_CRYPT_NONE)
264 crypt->length = crypt->stmf.length;
265 }
266
267 return crypt;
268 }
269
270 void
271 pdf_drop_crypt(fz_context *ctx, pdf_crypt *crypt)
272 {
273 if (!crypt)
274 return;
275
276 pdf_drop_obj(ctx, crypt->id);
277 pdf_drop_obj(ctx, crypt->cf);
278 fz_free(ctx, crypt);
279 }
280
281 /*
282 * Parse a CF dictionary entry (PDF 1.7 table 3.22)
283 */
284
285 static void
286 pdf_parse_crypt_filter(fz_context *ctx, pdf_crypt_filter *cf, pdf_crypt *crypt, pdf_obj *name)
287 {
288 pdf_obj *obj;
289 pdf_obj *dict;
290 int is_identity = (pdf_name_eq(ctx, name, PDF_NAME(Identity)));
291 int is_stdcf = (!is_identity && pdf_name_eq(ctx, name, PDF_NAME(StdCF)));
292
293 if (!is_identity && !is_stdcf)
294 fz_throw(ctx, FZ_ERROR_FORMAT, "Crypt Filter not Identity or StdCF (%d 0 R)", pdf_to_num(ctx, crypt->cf));
295
296 cf->method = PDF_CRYPT_NONE;
297 cf->length = crypt->length;
298
299 if (!crypt->cf)
300 {
301 cf->method = (is_identity ? PDF_CRYPT_NONE : PDF_CRYPT_RC4);
302 return;
303 }
304
305 dict = pdf_dict_get(ctx, crypt->cf, name);
306 if (pdf_is_dict(ctx, dict))
307 {
308 obj = pdf_dict_get(ctx, dict, PDF_NAME(CFM));
309 if (pdf_is_name(ctx, obj))
310 {
311 if (pdf_name_eq(ctx, PDF_NAME(None), obj))
312 cf->method = PDF_CRYPT_NONE;
313 else if (pdf_name_eq(ctx, PDF_NAME(V2), obj))
314 cf->method = PDF_CRYPT_RC4;
315 else if (pdf_name_eq(ctx, PDF_NAME(AESV2), obj))
316 {
317 cf->method = PDF_CRYPT_AESV2;
318 cf->length = 128;
319 }
320 else if (pdf_name_eq(ctx, PDF_NAME(AESV3), obj))
321 {
322 cf->method = PDF_CRYPT_AESV3;
323 cf->length = 256;
324 }
325 else
326 fz_warn(ctx, "unknown encryption method: %s", pdf_to_name(ctx, obj));
327 }
328
329 cf->length = pdf_dict_get_int_default(ctx, dict, PDF_NAME(Length), cf->length);
330 }
331 else if (!is_identity)
332 fz_throw(ctx, FZ_ERROR_FORMAT, "cannot parse crypt filter (%d 0 R)", pdf_to_num(ctx, crypt->cf));
333
334 if (cf->method != PDF_CRYPT_NONE)
335 {
336 if (crypt->r == 4 && cf->method != PDF_CRYPT_RC4 && cf->method != PDF_CRYPT_AESV2)
337 fz_warn(ctx, "unexpected encryption method for revision 4 crypto: %s", pdf_crypt_method(ctx, crypt));
338 else if (crypt->r >= 5 && cf->method != PDF_CRYPT_AESV3)
339 {
340 fz_warn(ctx, "illegal encryption method for revision 5/6, assuming AESV3");
341 cf->method = PDF_CRYPT_AESV3;
342 }
343 }
344
345 /* the length for crypt filters is supposed to be in bytes not bits */
346 if (cf->length < 40)
347 cf->length = cf->length * 8;
348
349 if ((cf->length % 8) != 0)
350 fz_throw(ctx, FZ_ERROR_FORMAT, "invalid key length: %d", cf->length);
351
352 if ((crypt->r == 1 || crypt->r == 2 || crypt->r == 3 || crypt->r == 4) &&
353 (cf->length < 40 || cf->length > 128))
354 fz_throw(ctx, FZ_ERROR_FORMAT, "invalid key length: %d", cf->length);
355 if ((crypt->r == 5 || crypt->r == 6) && cf->length != 256)
356 {
357 fz_warn(ctx, "illegal key length for revision 5/6, assuming 256 bits");
358 cf->length = 256;
359 }
360 }
361
362 /*
363 * Compute an encryption key (PDF 1.7 algorithm 3.2)
364 */
365
366 static const unsigned char padding[32] =
367 {
368 0x28, 0xbf, 0x4e, 0x5e, 0x4e, 0x75, 0x8a, 0x41,
369 0x64, 0x00, 0x4e, 0x56, 0xff, 0xfa, 0x01, 0x08,
370 0x2e, 0x2e, 0x00, 0xb6, 0xd0, 0x68, 0x3e, 0x80,
371 0x2f, 0x0c, 0xa9, 0xfe, 0x64, 0x53, 0x69, 0x7a
372 };
373
374 static void
375 pdf_compute_encryption_key(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen, unsigned char *key)
376 {
377 unsigned char buf[32];
378 unsigned int p;
379 int i, n;
380 fz_md5 md5;
381
382 n = fz_clampi(crypt->length / 8, 0, 16);
383
384 /* Step 1 - copy and pad password string */
385 if (pwlen > 32)
386 pwlen = 32;
387 memcpy(buf, password, pwlen);
388 if (pwlen < 32)
389 memcpy(buf + pwlen, padding, 32 - pwlen);
390
391 /* Step 2 - init md5 and pass value of step 1 */
392 fz_md5_init(&md5);
393 fz_md5_update(&md5, buf, 32);
394
395 /* Step 3 - pass O value */
396 fz_md5_update(&md5, crypt->o, 32);
397
398 /* Step 4 - pass P value as unsigned int, low-order byte first */
399 p = (unsigned int) crypt->p;
400 buf[0] = (p) & 0xFF;
401 buf[1] = (p >> 8) & 0xFF;
402 buf[2] = (p >> 16) & 0xFF;
403 buf[3] = (p >> 24) & 0xFF;
404 fz_md5_update(&md5, buf, 4);
405
406 /* Step 5 - pass first element of ID array */
407 fz_md5_update(&md5, (unsigned char *)pdf_to_str_buf(ctx, crypt->id), pdf_to_str_len(ctx, crypt->id));
408
409 /* Step 6 (revision 4 or greater) - if metadata is not encrypted pass 0xFFFFFFFF */
410 if (crypt->r >= 4)
411 {
412 if (!crypt->encrypt_metadata)
413 {
414 buf[0] = 0xFF;
415 buf[1] = 0xFF;
416 buf[2] = 0xFF;
417 buf[3] = 0xFF;
418 fz_md5_update(&md5, buf, 4);
419 }
420 }
421
422 /* Step 7 - finish the hash */
423 fz_md5_final(&md5, buf);
424
425 /* Step 8 (revision 3 or greater) - do some voodoo 50 times */
426 if (crypt->r >= 3)
427 {
428 for (i = 0; i < 50; i++)
429 {
430 fz_md5_init(&md5);
431 fz_md5_update(&md5, buf, n);
432 fz_md5_final(&md5, buf);
433 }
434 }
435
436 /* Step 9 - the key is the first 'n' bytes of the result */
437 memcpy(key, buf, n);
438 }
439
440 /*
441 * Compute an encryption key (PDF 1.7 ExtensionLevel 3 algorithm 3.2a)
442 */
443
444 static void
445 pdf_compute_encryption_key_r5(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen, int ownerkey, unsigned char *validationkey)
446 {
447 unsigned char buffer[128 + 8 + 48];
448 fz_sha256 sha256;
449 fz_aes aes;
450
451 /* Step 2 - truncate UTF-8 password to 127 characters */
452
453 if (pwlen > 127)
454 pwlen = 127;
455
456 /* Step 3/4 - test password against owner/user key and compute encryption key */
457
458 memcpy(buffer, password, pwlen);
459 if (ownerkey)
460 {
461 memcpy(buffer + pwlen, crypt->o + 32, 8);
462 memcpy(buffer + pwlen + 8, crypt->u, 48);
463 }
464 else
465 memcpy(buffer + pwlen, crypt->u + 32, 8);
466
467 fz_sha256_init(&sha256);
468 fz_sha256_update(&sha256, buffer, pwlen + 8 + (ownerkey ? 48 : 0));
469 fz_sha256_final(&sha256, validationkey);
470
471 /* Step 3.5/4.5 - compute file encryption key from OE/UE */
472
473 if (ownerkey)
474 {
475 memcpy(buffer + pwlen, crypt->o + 40, 8);
476 memcpy(buffer + pwlen + 8, crypt->u, 48);
477 }
478 else
479 memcpy(buffer + pwlen, crypt->u + 40, 8);
480
481 fz_sha256_init(&sha256);
482 fz_sha256_update(&sha256, buffer, pwlen + 8 + (ownerkey ? 48 : 0));
483 fz_sha256_final(&sha256, buffer);
484
485 /* clear password buffer and use it as iv */
486 memset(buffer + 32, 0, sizeof(buffer) - 32);
487 if (fz_aes_setkey_dec(&aes, buffer, crypt->length))
488 fz_throw(ctx, FZ_ERROR_FORMAT, "aes invalid key size (%d)", crypt->length);
489 fz_aes_crypt_cbc(&aes, FZ_AES_DECRYPT, 32, buffer + 32, ownerkey ? crypt->oe : crypt->ue, crypt->key);
490 }
491
492 /*
493 * Compute an encryption key (PDF 1.7 ExtensionLevel 8 algorithm)
494 *
495 * Adobe has not yet released the details, so the algorithm reference is:
496 * http://esec-lab.sogeti.com/post/The-undocumented-password-validation-algorithm-of-Adobe-Reader-X
497 */
498
499 static void
500 pdf_compute_hardened_hash_r6(fz_context *ctx, unsigned char *password, size_t pwlen, unsigned char salt[8], unsigned char *ownerkey, unsigned char hash[32])
501 {
502 unsigned char data[(128 + 64 + 48) * 64];
503 unsigned char block[64];
504 int block_size = 32;
505 size_t data_len = 0;
506 int i, j, sum;
507
508 fz_sha256 sha256;
509 fz_sha384 sha384;
510 fz_sha512 sha512;
511 fz_aes aes;
512
513 /* Step 1: calculate initial data block */
514 fz_sha256_init(&sha256);
515 fz_sha256_update(&sha256, password, pwlen);
516 fz_sha256_update(&sha256, salt, 8);
517 if (ownerkey)
518 fz_sha256_update(&sha256, ownerkey, 48);
519 fz_sha256_final(&sha256, block);
520
521 for (i = 0; i < 64 || i < data[data_len * 64 - 1] + 32; i++)
522 {
523 /* Step 2: repeat password and data block 64 times */
524 memcpy(data, password, pwlen);
525 memcpy(data + pwlen, block, block_size);
526 if (ownerkey)
527 memcpy(data + pwlen + block_size, ownerkey, 48);
528 data_len = pwlen + block_size + (ownerkey ? 48 : 0);
529 for (j = 1; j < 64; j++)
530 memcpy(data + j * data_len, data, data_len);
531
532 /* Step 3: encrypt data using data block as key and iv */
533 (void)fz_aes_setkey_enc(&aes, block, 128);
534 fz_aes_crypt_cbc(&aes, FZ_AES_ENCRYPT, data_len * 64, block + 16, data, data);
535
536 /* Step 4: determine SHA-2 hash size for this round */
537 for (j = 0, sum = 0; j < 16; j++)
538 sum += data[j];
539
540 /* Step 5: calculate data block for next round */
541 block_size = 32 + (sum % 3) * 16;
542 switch (block_size)
543 {
544 case 32:
545 fz_sha256_init(&sha256);
546 fz_sha256_update(&sha256, data, data_len * 64);
547 fz_sha256_final(&sha256, block);
548 break;
549 case 48:
550 fz_sha384_init(&sha384);
551 fz_sha384_update(&sha384, data, data_len * 64);
552 fz_sha384_final(&sha384, block);
553 break;
554 case 64:
555 fz_sha512_init(&sha512);
556 fz_sha512_update(&sha512, data, data_len * 64);
557 fz_sha512_final(&sha512, block);
558 break;
559 }
560 }
561
562 memset(data, 0, sizeof(data));
563 memcpy(hash, block, 32);
564 }
565
566 static void
567 pdf_compute_encryption_key_r6(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen, int ownerkey, unsigned char *validationkey)
568 {
569 unsigned char hash[32];
570 unsigned char iv[16];
571 fz_aes aes;
572
573 if (pwlen > 127)
574 pwlen = 127;
575
576 pdf_compute_hardened_hash_r6(ctx, password, pwlen,
577 (ownerkey ? crypt->o : crypt->u) + 32,
578 ownerkey ? crypt->u : NULL, validationkey);
579 pdf_compute_hardened_hash_r6(ctx, password, pwlen,
580 (ownerkey ? crypt->o : crypt->u) + 40,
581 (ownerkey ? crypt->u : NULL),
582 hash);
583
584 memset(iv, 0, sizeof(iv));
585 (void)fz_aes_setkey_dec(&aes, hash, 256);
586 fz_aes_crypt_cbc(&aes, FZ_AES_DECRYPT, 32, iv, ownerkey ? crypt->oe : crypt->ue, crypt->key);
587 }
588
589 /*
590 * Computing the user password (PDF 1.7 algorithm 3.4 and 3.5)
591 * Also save the generated key for decrypting objects and streams in crypt->key.
592 */
593
594 static void
595 pdf_compute_user_password(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen, unsigned char *output)
596 {
597 int n = fz_clampi(crypt->length / 8, 0, 16);
598
599 if (crypt->r == 2)
600 {
601 fz_arc4 arc4;
602
603 pdf_compute_encryption_key(ctx, crypt, password, pwlen, crypt->key);
604 fz_arc4_init(&arc4, crypt->key, n);
605 fz_arc4_encrypt(&arc4, output, padding, 32);
606 }
607
608 if (crypt->r == 3 || crypt->r == 4)
609 {
610 unsigned char xor[32];
611 unsigned char digest[16];
612 fz_md5 md5;
613 fz_arc4 arc4;
614 int i, x;
615
616 pdf_compute_encryption_key(ctx, crypt, password, pwlen, crypt->key);
617
618 fz_md5_init(&md5);
619 fz_md5_update(&md5, padding, 32);
620 fz_md5_update(&md5, (unsigned char*)pdf_to_str_buf(ctx, crypt->id), pdf_to_str_len(ctx, crypt->id));
621 fz_md5_final(&md5, digest);
622
623 fz_arc4_init(&arc4, crypt->key, n);
624 fz_arc4_encrypt(&arc4, output, digest, 16);
625
626 for (x = 1; x <= 19; x++)
627 {
628 for (i = 0; i < n; i++)
629 xor[i] = crypt->key[i] ^ x;
630 fz_arc4_init(&arc4, xor, n);
631 fz_arc4_encrypt(&arc4, output, output, 16);
632 }
633
634 memcpy(output + 16, padding, 16);
635 }
636
637 if (crypt->r == 5)
638 {
639 pdf_compute_encryption_key_r5(ctx, crypt, password, pwlen, 0, output);
640 }
641
642 if (crypt->r == 6)
643 {
644 pdf_compute_encryption_key_r6(ctx, crypt, password, pwlen, 0, output);
645 }
646 }
647
648 /*
649 * Authenticating the user password (PDF 1.7 algorithm 3.6
650 * and ExtensionLevel 3 algorithm 3.11)
651 * This also has the side effect of saving a key generated
652 * from the password for decrypting objects and streams.
653 */
654
655 static int
656 pdf_authenticate_user_password(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen)
657 {
658 unsigned char output[32];
659 pdf_compute_user_password(ctx, crypt, password, pwlen, output);
660 if (crypt->r == 2 || crypt->r == 5 || crypt->r == 6)
661 return memcmp(output, crypt->u, 32) == 0;
662 if (crypt->r == 3 || crypt->r == 4)
663 return memcmp(output, crypt->u, 16) == 0;
664 return 0;
665 }
666
667 /*
668 * Authenticating the owner password (PDF 1.7 algorithm 3.7,
669 * ExtensionLevel 3 algorithm 3.12, ExtensionLevel 8 algorithm)
670 * Generates the user password from the owner password
671 * and calls pdf_authenticate_user_password.
672 */
673
674 static int
675 pdf_authenticate_owner_password(fz_context *ctx, pdf_crypt *crypt, unsigned char *ownerpass, size_t pwlen)
676 {
677 int n = fz_clampi(crypt->length / 8, 0, 16);
678
679 if (crypt->r == 2)
680 {
681 unsigned char pwbuf[32];
682 unsigned char key[16];
683 unsigned char userpass[32];
684 fz_md5 md5;
685 fz_arc4 arc4;
686
687 if (pwlen > 32)
688 pwlen = 32;
689 memcpy(pwbuf, ownerpass, pwlen);
690 if (pwlen < 32)
691 memcpy(pwbuf + pwlen, padding, 32 - pwlen);
692
693 fz_md5_init(&md5);
694 fz_md5_update(&md5, pwbuf, 32);
695 fz_md5_final(&md5, key);
696
697 fz_arc4_init(&arc4, key, n);
698 fz_arc4_encrypt(&arc4, userpass, crypt->o, 32);
699
700 return pdf_authenticate_user_password(ctx, crypt, userpass, 32);
701 }
702
703 if (crypt->r == 3 || crypt->r == 4)
704 {
705 unsigned char pwbuf[32];
706 unsigned char key[16];
707 unsigned char xor[32];
708 unsigned char userpass[32];
709 int i, x;
710 fz_md5 md5;
711 fz_arc4 arc4;
712
713 if (pwlen > 32)
714 pwlen = 32;
715 memcpy(pwbuf, ownerpass, pwlen);
716 if (pwlen < 32)
717 memcpy(pwbuf + pwlen, padding, 32 - pwlen);
718
719 fz_md5_init(&md5);
720 fz_md5_update(&md5, pwbuf, 32);
721 fz_md5_final(&md5, key);
722
723 for (i = 0; i < 50; i++)
724 {
725 fz_md5_init(&md5);
726 fz_md5_update(&md5, key, n);
727 fz_md5_final(&md5, key);
728 }
729
730 memcpy(userpass, crypt->o, 32);
731 for (x = 0; x < 20; x++)
732 {
733 for (i = 0; i < n; i++)
734 xor[i] = key[i] ^ (19 - x);
735 fz_arc4_init(&arc4, xor, n);
736 fz_arc4_encrypt(&arc4, userpass, userpass, 32);
737 }
738
739 return pdf_authenticate_user_password(ctx, crypt, userpass, 32);
740 }
741
742 if (crypt->r == 5)
743 {
744 unsigned char key[32];
745 pdf_compute_encryption_key_r5(ctx, crypt, ownerpass, pwlen, 1, key);
746 return !memcmp(key, crypt->o, 32);
747 }
748
749 if (crypt->r == 6)
750 {
751 unsigned char key[32];
752 pdf_compute_encryption_key_r6(ctx, crypt, ownerpass, pwlen, 1, key);
753 return !memcmp(key, crypt->o, 32);
754 }
755
756 return 0;
757 }
758
759 static void pdf_docenc_from_utf8(char *password, const char *utf8, int n)
760 {
761 int i = 0, k, c;
762 while (*utf8 && i + 1 < n)
763 {
764 utf8 += fz_chartorune(&c, utf8);
765 for (k = 0; k < 256; k++)
766 {
767 if (c == fz_unicode_from_pdf_doc_encoding[k])
768 {
769 password[i++] = k;
770 break;
771 }
772 }
773 /* FIXME: drop characters that can't be encoded or return an error? */
774 }
775 password[i] = 0;
776 }
777
778 static void pdf_saslprep_from_utf8(char *password, const char *utf8, int n)
779 {
780 /* TODO: stringprep with SALSprep profile */
781 fz_strlcpy(password, utf8, n);
782 }
783
784 int
785 pdf_authenticate_password(fz_context *ctx, pdf_document *doc, const char *pwd_utf8)
786 {
787 char password[2048];
788 int auth;
789
790 if (!doc->crypt)
791 return 1; /* No password required */
792
793 password[0] = 0;
794 if (pwd_utf8)
795 {
796 if (doc->crypt->r <= 4)
797 pdf_docenc_from_utf8(password, pwd_utf8, sizeof password);
798 else
799 pdf_saslprep_from_utf8(password, pwd_utf8, sizeof password);
800 }
801
802 auth = 0;
803 if (pdf_authenticate_user_password(ctx, doc->crypt, (unsigned char *)password, strlen(password)))
804 auth = 2;
805 if (pdf_authenticate_owner_password(ctx, doc->crypt, (unsigned char *)password, strlen(password)))
806 auth |= 4;
807 else if (auth & 2)
808 {
809 /* We need to reauthenticate the user password,
810 * because the failed attempt to authenticate
811 * the owner password will have invalidated the
812 * stored keys. */
813 (void)pdf_authenticate_user_password(ctx, doc->crypt, (unsigned char *)password, strlen(password));
814 }
815
816 /* To match Acrobat, we choose not to allow an empty owner
817 * password, unless the user password is also the empty one. */
818 if (*password == 0 && auth == 4)
819 return 0;
820
821 return auth;
822 }
823
824 int
825 pdf_needs_password(fz_context *ctx, pdf_document *doc)
826 {
827 if (!doc->crypt)
828 return 0;
829 if (pdf_authenticate_password(ctx, doc, ""))
830 return 0;
831 return 1;
832 }
833
834 int
835 pdf_has_permission(fz_context *ctx, pdf_document *doc, fz_permission p)
836 {
837 if (!doc->crypt)
838 return 1;
839 switch (p)
840 {
841 case FZ_PERMISSION_PRINT: return doc->crypt->p & PDF_PERM_PRINT;
842 case FZ_PERMISSION_EDIT: return doc->crypt->p & PDF_PERM_MODIFY;
843 case FZ_PERMISSION_COPY: return doc->crypt->p & PDF_PERM_COPY;
844 case FZ_PERMISSION_ANNOTATE: return doc->crypt->p & PDF_PERM_ANNOTATE;
845 case FZ_PERMISSION_FORM: return doc->crypt->p & PDF_PERM_FORM;
846 case FZ_PERMISSION_ACCESSIBILITY: return doc->crypt->p & PDF_PERM_ACCESSIBILITY;
847 case FZ_PERMISSION_ASSEMBLE: return doc->crypt->p & PDF_PERM_ASSEMBLE;
848 case FZ_PERMISSION_PRINT_HQ: return doc->crypt->p & PDF_PERM_PRINT_HQ;
849 }
850 return 1;
851 }
852
853 int
854 pdf_document_permissions(fz_context *ctx, pdf_document *doc)
855 {
856 if (doc->crypt)
857 return doc->crypt->p;
858 /* all permissions granted, reserved bits set appropriately */
859 return (int)0xFFFFFFFC;
860 }
861
862 /*
863 * Compute the owner password (PDF 1.7 algorithm 3.3)
864 */
865
866 static void
867 pdf_compute_owner_password(fz_context *ctx, pdf_crypt *crypt, unsigned char *opassword, size_t opwlen, unsigned char *upassword, size_t upwlen, unsigned char *output)
868 {
869 unsigned char obuf[32];
870 unsigned char ubuf[32];
871 unsigned char digest[32];
872 int i, n;
873 fz_md5 md5;
874 fz_arc4 arc4;
875
876 n = fz_clampi(crypt->length / 8, 0, 16);
877
878 /* Step 1 - copy and pad owner password string */
879 if (opwlen > 32)
880 opwlen = 32;
881 memcpy(obuf, opassword, opwlen);
882 if (opwlen < 32)
883 memcpy(obuf + opwlen, padding, 32 - opwlen);
884
885 /* Step 2 - init md5 and pass value of step 1 */
886 fz_md5_init(&md5);
887 fz_md5_update(&md5, obuf, 32);
888 fz_md5_final(&md5, obuf);
889
890 /* Step 3 (revision 3 or greater) - do some voodoo 50 times */
891 if (crypt->r >= 3)
892 {
893 for (i = 0; i < 50; i++)
894 {
895 fz_md5_init(&md5);
896 fz_md5_update(&md5, obuf, n);
897 fz_md5_final(&md5, obuf);
898 }
899 }
900
901 /* Step 4 - encrypt owner password md5 hash */
902 fz_arc4_init(&arc4, obuf, n);
903
904 /* Step 5 - copy and pad user password string */
905 if (upwlen > 32)
906 upwlen = 32;
907 memcpy(ubuf, upassword, upwlen);
908 if (upwlen < 32)
909 memcpy(ubuf + upwlen, padding, 32 - upwlen);
910
911 /* Step 6 - encrypt user password md5 hash */
912 fz_arc4_encrypt(&arc4, digest, ubuf, 32);
913
914 /* Step 7 - */
915 if (crypt->r >= 3)
916 {
917 unsigned char xor[32];
918 int x;
919
920 for (x = 1; x <= 19; x++)
921 {
922 for (i = 0; i < n; i++)
923 xor[i] = obuf[i] ^ x;
924 fz_arc4_init(&arc4, xor, n);
925 fz_arc4_encrypt(&arc4, digest, digest, 32);
926 }
927 }
928
929 /* Step 8 - the owner password is the first 16 bytes of the result */
930 memcpy(output, digest, 32);
931 }
932
933 unsigned char *
934 pdf_crypt_key(fz_context *ctx, pdf_crypt *crypt)
935 {
936 if (crypt)
937 return crypt->key;
938 return NULL;
939 }
940
941 int
942 pdf_crypt_version(fz_context *ctx, pdf_crypt *crypt)
943 {
944 if (crypt)
945 return crypt->v;
946 return 0;
947 }
948
949 int pdf_crypt_revision(fz_context *ctx, pdf_crypt *crypt)
950 {
951 if (crypt)
952 return crypt->r;
953 return 0;
954 }
955
956 static char *
957 crypt_method(fz_context *ctx, int method)
958 {
959 switch (method)
960 {
961 default:
962 case PDF_CRYPT_UNKNOWN: return "Unknown";
963 case PDF_CRYPT_NONE: return "None";
964 case PDF_CRYPT_RC4: return "RC4";
965 case PDF_CRYPT_AESV2: return "AES";
966 case PDF_CRYPT_AESV3: return "AES";
967 }
968 }
969
970 const char *
971 pdf_crypt_string_method(fz_context *ctx, pdf_crypt *crypt)
972 {
973 if (crypt)
974 return crypt_method(ctx, crypt->strf.method);
975 return "None";
976 }
977
978 const char *
979 pdf_crypt_stream_method(fz_context *ctx, pdf_crypt *crypt)
980 {
981 if (crypt)
982 return crypt_method(ctx, crypt->stmf.method);
983 return "None";
984 }
985
986 const char *
987 pdf_crypt_method(fz_context *ctx, pdf_crypt *crypt)
988 {
989 return pdf_crypt_string_method(ctx, crypt);
990 }
991
992 int
993 pdf_crypt_length(fz_context *ctx, pdf_crypt *crypt)
994 {
995 if (crypt)
996 return crypt->length;
997 return 0;
998 }
999
1000 int
1001 pdf_crypt_permissions(fz_context *ctx, pdf_crypt *crypt)
1002 {
1003 if (crypt)
1004 return crypt->p;
1005 return 0;
1006 }
1007
1008 int
1009 pdf_crypt_encrypt_metadata(fz_context *ctx, pdf_crypt *crypt)
1010 {
1011 if (crypt)
1012 return crypt->encrypt_metadata;
1013 return 0;
1014 }
1015
1016 unsigned char *
1017 pdf_crypt_owner_password(fz_context *ctx, pdf_crypt *crypt)
1018 {
1019 if (crypt)
1020 return crypt->o;
1021 return NULL;
1022 }
1023
1024 unsigned char *
1025 pdf_crypt_user_password(fz_context *ctx, pdf_crypt *crypt)
1026 {
1027 if (crypt)
1028 return crypt->u;
1029 return NULL;
1030 }
1031
1032 unsigned char *
1033 pdf_crypt_owner_encryption(fz_context *ctx, pdf_crypt *crypt)
1034 {
1035 if (crypt)
1036 return crypt->oe;
1037 return NULL;
1038 }
1039
1040 unsigned char *
1041 pdf_crypt_user_encryption(fz_context *ctx, pdf_crypt *crypt)
1042 {
1043 if (crypt)
1044 return crypt->ue;
1045 return NULL;
1046 }
1047
1048 unsigned char *
1049 pdf_crypt_permissions_encryption(fz_context *ctx, pdf_crypt *crypt)
1050 {
1051 if (crypt)
1052 return crypt->perms;
1053 return 0;
1054 }
1055
1056 /*
1057 * PDF 1.7 algorithm 3.1 and ExtensionLevel 3 algorithm 3.1a
1058 *
1059 * Using the global encryption key that was generated from the
1060 * password, create a new key that is used to decrypt individual
1061 * objects and streams. This key is based on the object and
1062 * generation numbers.
1063 */
1064
1065 static int
1066 pdf_compute_object_key(pdf_crypt *crypt, pdf_crypt_filter *cf, int num, int gen, unsigned char *key, int max_len)
1067 {
1068 fz_md5 md5;
1069 unsigned char message[5];
1070 int key_len = crypt->length / 8;
1071
1072 if (key_len > max_len)
1073 key_len = max_len;
1074
1075 /* Encryption method version 0 is undocumented, but a lucky
1076 guess revealed that all streams/strings in those PDFs are
1077 encrypted using the same 40 bit file encryption key using RC4. */
1078 if (crypt->v == 0 || cf->method == PDF_CRYPT_AESV3)
1079 {
1080 memcpy(key, crypt->key, key_len);
1081 return key_len;
1082 }
1083
1084 fz_md5_init(&md5);
1085 fz_md5_update(&md5, crypt->key, key_len);
1086 message[0] = (num) & 0xFF;
1087 message[1] = (num >> 8) & 0xFF;
1088 message[2] = (num >> 16) & 0xFF;
1089 message[3] = (gen) & 0xFF;
1090 message[4] = (gen >> 8) & 0xFF;
1091 fz_md5_update(&md5, message, 5);
1092
1093 if (cf->method == PDF_CRYPT_AESV2)
1094 fz_md5_update(&md5, (unsigned char *)"sAlT", 4);
1095
1096 fz_md5_final(&md5, key);
1097
1098 if (key_len + 5 > 16)
1099 return 16;
1100 return key_len + 5;
1101 }
1102
1103 /*
1104 * PDF 1.7 algorithm 3.1 and ExtensionLevel 3 algorithm 3.1a
1105 *
1106 * Decrypt all strings in obj modifying the data in-place.
1107 * Recurse through arrays and dictionaries, but do not follow
1108 * indirect references.
1109 */
1110
1111 static int is_signature(fz_context *ctx, pdf_obj *obj)
1112 {
1113 if (pdf_dict_get(ctx, obj, PDF_NAME(Type)) == PDF_NAME(Sig))
1114 if (pdf_dict_get(ctx, obj, PDF_NAME(Contents)) && pdf_dict_get(ctx, obj, PDF_NAME(ByteRange)) && pdf_dict_get(ctx, obj, PDF_NAME(Filter)))
1115 return 1;
1116 return 0;
1117 }
1118
1119 static void
1120 pdf_crypt_obj_imp(fz_context *ctx, pdf_crypt *crypt, pdf_obj *obj, unsigned char *key, int keylen)
1121 {
1122 unsigned char *s;
1123 int i;
1124
1125 if (pdf_is_indirect(ctx, obj))
1126 return;
1127
1128 if (pdf_is_string(ctx, obj))
1129 {
1130 size_t n = pdf_to_str_len(ctx, obj);
1131 s = (unsigned char *)pdf_to_str_buf(ctx, obj);
1132
1133 if (crypt->strf.method == PDF_CRYPT_RC4)
1134 {
1135 fz_arc4 arc4;
1136 fz_arc4_init(&arc4, key, keylen);
1137 fz_arc4_encrypt(&arc4, s, s, n);
1138 }
1139
1140 if (crypt->strf.method == PDF_CRYPT_AESV2 || crypt->strf.method == PDF_CRYPT_AESV3)
1141 {
1142 if (n == 0)
1143 {
1144 /* Empty strings are permissible */
1145 }
1146 else if (n & 15 || n < 32)
1147 fz_warn(ctx, "invalid string length for aes encryption");
1148 else
1149 {
1150 unsigned char iv[16];
1151 fz_aes aes;
1152 memcpy(iv, s, 16);
1153 if (fz_aes_setkey_dec(&aes, key, keylen * 8))
1154 fz_throw(ctx, FZ_ERROR_FORMAT, "AES key init failed (keylen=%d)", keylen * 8);
1155 fz_aes_crypt_cbc(&aes, FZ_AES_DECRYPT, n - 16, iv, s + 16, s);
1156 /* delete space used for iv and padding bytes at end */
1157 if (s[n - 17] < 1 || s[n - 17] > 16)
1158 fz_warn(ctx, "aes padding out of range");
1159 else
1160 pdf_set_str_len(ctx, obj, n - 16 - s[n - 17]);
1161 }
1162 }
1163 }
1164
1165 else if (pdf_is_array(ctx, obj))
1166 {
1167 int n = pdf_array_len(ctx, obj);
1168 for (i = 0; i < n; i++)
1169 {
1170 pdf_crypt_obj_imp(ctx, crypt, pdf_array_get(ctx, obj, i), key, keylen);
1171 }
1172 }
1173
1174 else if (pdf_is_dict(ctx, obj))
1175 {
1176 int n = pdf_dict_len(ctx, obj);
1177 for (i = 0; i < n; i++)
1178 {
1179 if (pdf_dict_get_key(ctx, obj, i) == PDF_NAME(Contents) && is_signature(ctx, obj))
1180 continue;
1181
1182 pdf_crypt_obj_imp(ctx, crypt, pdf_dict_get_val(ctx, obj, i), key, keylen);
1183 }
1184 }
1185 }
1186
1187 void
1188 pdf_crypt_obj(fz_context *ctx, pdf_crypt *crypt, pdf_obj *obj, int num, int gen)
1189 {
1190 unsigned char key[32];
1191 int len;
1192
1193 len = pdf_compute_object_key(crypt, &crypt->strf, num, gen, key, 32);
1194
1195 pdf_crypt_obj_imp(ctx, crypt, obj, key, len);
1196 }
1197
1198 /*
1199 * PDF 1.7 algorithm 3.1 and ExtensionLevel 3 algorithm 3.1a
1200 *
1201 * Create filter suitable for de/encrypting a stream.
1202 */
1203 static fz_stream *
1204 pdf_open_crypt_imp(fz_context *ctx, fz_stream *chain, pdf_crypt *crypt, pdf_crypt_filter *stmf, int num, int gen)
1205 {
1206 unsigned char key[32];
1207 int len;
1208
1209 len = pdf_compute_object_key(crypt, stmf, num, gen, key, 32);
1210
1211 if (stmf->method == PDF_CRYPT_RC4)
1212 return fz_open_arc4(ctx, chain, key, len);
1213
1214 if (stmf->method == PDF_CRYPT_AESV2 || stmf->method == PDF_CRYPT_AESV3)
1215 return fz_open_aesd(ctx, chain, key, len);
1216
1217 return fz_keep_stream(ctx, chain);
1218 }
1219
1220 fz_stream *
1221 pdf_open_crypt(fz_context *ctx, fz_stream *chain, pdf_crypt *crypt, int num, int gen)
1222 {
1223 return pdf_open_crypt_imp(ctx, chain, crypt, &crypt->stmf, num, gen);
1224 }
1225
1226 fz_stream *
1227 pdf_open_crypt_with_filter(fz_context *ctx, fz_stream *chain, pdf_crypt *crypt, pdf_obj *name, int num, int gen)
1228 {
1229 if (!pdf_name_eq(ctx, name, PDF_NAME(Identity)))
1230 {
1231 pdf_crypt_filter cf;
1232 pdf_parse_crypt_filter(ctx, &cf, crypt, name);
1233 return pdf_open_crypt_imp(ctx, chain, crypt, &cf, num, gen);
1234 }
1235 return fz_keep_stream(ctx, chain);
1236 }
1237
1238 void
1239 pdf_print_crypt(fz_context *ctx, fz_output *out, pdf_crypt *crypt)
1240 {
1241 int i;
1242
1243 fz_write_printf(ctx, out, "crypt {\n");
1244
1245 fz_write_printf(ctx, out, "\tv=%d length=%d\n", crypt->v, crypt->length);
1246 fz_write_printf(ctx, out, "\tstmf method=%d length=%d\n", crypt->stmf.method, crypt->stmf.length);
1247 fz_write_printf(ctx, out, "\tstrf method=%d length=%d\n", crypt->strf.method, crypt->strf.length);
1248 fz_write_printf(ctx, out, "\tr=%d\n", crypt->r);
1249
1250 fz_write_printf(ctx, out, "\to=<");
1251 for (i = 0; i < 32; i++)
1252 fz_write_printf(ctx, out, "%02X", crypt->o[i]);
1253 fz_write_printf(ctx, out, ">\n");
1254
1255 fz_write_printf(ctx, out, "\tu=<");
1256 for (i = 0; i < 32; i++)
1257 fz_write_printf(ctx, out, "%02X", crypt->u[i]);
1258 fz_write_printf(ctx, out, ">\n");
1259
1260 fz_write_printf(ctx, out, "}\n");
1261 }
1262
1263 void pdf_encrypt_data(fz_context *ctx, pdf_crypt *crypt, int num, int gen, void (*write_data)(fz_context *ctx, void *, const unsigned char *, size_t), void *arg, const unsigned char *s, size_t n)
1264 {
1265 unsigned char buffer[256];
1266 unsigned char key[32];
1267 int keylen;
1268
1269 if (crypt == NULL)
1270 {
1271 write_data(ctx, arg, s, n);
1272 return;
1273 }
1274
1275 keylen = pdf_compute_object_key(crypt, &crypt->strf, num, gen, key, 32);
1276
1277 if (crypt->strf.method == PDF_CRYPT_RC4)
1278 {
1279 fz_arc4 arc4;
1280 fz_arc4_init(&arc4, key, keylen);
1281 while (n > 0)
1282 {
1283 size_t len = n;
1284 if (len > (int)sizeof(buffer))
1285 len = sizeof(buffer);
1286 fz_arc4_encrypt(&arc4, buffer, s, len);
1287 write_data(ctx, arg, buffer, len);
1288 s += len;
1289 n -= len;
1290 }
1291 return;
1292 }
1293
1294 if (crypt->strf.method == PDF_CRYPT_AESV2 || crypt->strf.method == PDF_CRYPT_AESV3)
1295 {
1296 size_t len = 0;
1297 fz_aes aes;
1298 unsigned char iv[16];
1299
1300 /* Empty strings can be represented by empty strings */
1301 if (n == 0)
1302 return;
1303
1304 if (fz_aes_setkey_enc(&aes, key, keylen * 8))
1305 fz_throw(ctx, FZ_ERROR_FORMAT, "AES key init failed (keylen=%d)", keylen * 8);
1306
1307 fz_memrnd(ctx, iv, 16);
1308 write_data(ctx, arg, iv, 16);
1309
1310 while (n > 0)
1311 {
1312 len = n;
1313 if (len > 16)
1314 len = 16;
1315 memcpy(buffer, s, len);
1316 if (len != 16)
1317 memset(&buffer[len], 16-(int)len, 16-len);
1318 fz_aes_crypt_cbc(&aes, FZ_AES_ENCRYPT, 16, iv, buffer, buffer+16);
1319 write_data(ctx, arg, buffer+16, 16);
1320 s += len;
1321 n -= len;
1322 }
1323 if (len == 16) {
1324 memset(buffer, 16, 16);
1325 fz_aes_crypt_cbc(&aes, FZ_AES_ENCRYPT, 16, iv, buffer, buffer+16);
1326 write_data(ctx, arg, buffer+16, 16);
1327 }
1328 return;
1329 }
1330
1331 /* Should never happen, but... */
1332 write_data(ctx, arg, s, n);
1333 }
1334
1335 size_t pdf_encrypted_len(fz_context *ctx, pdf_crypt *crypt, int num, int gen, size_t len)
1336 {
1337 if (crypt == NULL)
1338 return len;
1339
1340 if (crypt->strf.method == PDF_CRYPT_AESV2 || crypt->strf.method == PDF_CRYPT_AESV3)
1341 {
1342 len += 16; /* 16 for IV */
1343 if ((len & 15) == 0)
1344 len += 16; /* Another 16 if our last block is full anyway */
1345 len = (len + 15) & ~15; /* And pad to the block */
1346 }
1347
1348 return len;
1349 }
1350
1351 /* PDF 2.0 algorithm 8 */
1352 static void
1353 pdf_compute_user_password_r6(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen, unsigned char *outputpw, unsigned char *outputencryption)
1354 {
1355 unsigned char validationsalt[8];
1356 unsigned char keysalt[8];
1357 unsigned char hash[32];
1358 unsigned char iv[16];
1359 fz_aes aes;
1360
1361 /* Step a) - Generate random salts. */
1362 fz_memrnd(ctx, validationsalt, nelem(validationsalt));
1363 fz_memrnd(ctx, keysalt, nelem(keysalt));
1364
1365 /* Step a) - Compute 32 byte hash given password and validation salt. */
1366 pdf_compute_hardened_hash_r6(ctx, password, pwlen, validationsalt, NULL, outputpw);
1367 memcpy(outputpw + 32, validationsalt, nelem(validationsalt));
1368 memcpy(outputpw + 40, keysalt, nelem(keysalt));
1369
1370 /* Step b) - Compute 32 byte hash given password and user salt. */
1371 pdf_compute_hardened_hash_r6(ctx, password, pwlen, keysalt, NULL, hash);
1372
1373 /* Step b) - Use hash as AES-key when encrypting the file encryption key. */
1374 memset(iv, 0, sizeof(iv));
1375 (void)fz_aes_setkey_enc(&aes, hash, 256);
1376 fz_aes_crypt_cbc(&aes, FZ_AES_ENCRYPT, 32, iv, crypt->key, outputencryption);
1377 }
1378
1379 /* PDF 2.0 algorithm 9 */
1380 static void
1381 pdf_compute_owner_password_r6(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen, unsigned char *outputpw, unsigned char *outputencryption)
1382 {
1383 unsigned char validationsalt[8];
1384 unsigned char keysalt[8];
1385 unsigned char hash[32];
1386 unsigned char iv[16];
1387 fz_aes aes;
1388
1389 /* Step a) - Generate random salts. */
1390 fz_memrnd(ctx, validationsalt, nelem(validationsalt));
1391 fz_memrnd(ctx, keysalt, nelem(keysalt));
1392
1393 /* Step a) - Compute 32 byte hash given owner password, validation salt and user password. */
1394 pdf_compute_hardened_hash_r6(ctx, password, pwlen, validationsalt, crypt->u, outputpw);
1395 memcpy(outputpw + 32, validationsalt, nelem(validationsalt));
1396 memcpy(outputpw + 40, keysalt, nelem(keysalt));
1397
1398 /* Step b) - Compute 32 byte hash given owner password, user salt and user password. */
1399 pdf_compute_hardened_hash_r6(ctx, password, pwlen, keysalt, crypt->u, hash);
1400
1401 /* Step b) - Use hash as AES-key when encrypting the file encryption key. */
1402 memset(iv, 0, sizeof(iv));
1403 (void)fz_aes_setkey_enc(&aes, hash, 256);
1404 fz_aes_crypt_cbc(&aes, FZ_AES_ENCRYPT, 32, iv, crypt->key, outputencryption);
1405 }
1406
1407 /* PDF 2.0 algorithm 10 */
1408 static void
1409 pdf_compute_permissions_r6(fz_context *ctx, pdf_crypt *crypt, unsigned char *output)
1410 {
1411 unsigned char buf[16];
1412 unsigned char iv[16];
1413 fz_aes aes;
1414
1415 /* Steps a) and b) - Extend permissions field and put into lower order bytes. */
1416 memcpy(buf, (unsigned char *) &crypt->p, 4);
1417 memset(&buf[4], 0xff, 4);
1418
1419 /* Step c) - Encode EncryptMetadata as T/F. */
1420 buf[8] = crypt->encrypt_metadata ? 'T' : 'F';
1421
1422 /* Step d) - Encode ASCII characters "adb". */
1423 buf[9] = 'a';
1424 buf[10] = 'd';
1425 buf[11] = 'b';
1426
1427 /* Step e) - Encode 4 random bytes. */
1428 fz_memrnd(ctx, &buf[12], 4);
1429
1430 /* Step f) - Use file encryption key as AES-key when encrypting buffer. */
1431 memset(iv, 0, sizeof(iv));
1432 (void)fz_aes_setkey_enc(&aes, crypt->key, 256);
1433 fz_aes_crypt_cbc(&aes, FZ_AES_ENCRYPT, 16, iv, buf, output);
1434 }
1435
1436 pdf_crypt *
1437 pdf_new_encrypt(fz_context *ctx, const char *opwd_utf8, const char *upwd_utf8, pdf_obj *id, int permissions, int algorithm)
1438 {
1439 pdf_crypt *crypt;
1440 int v, r, method, length;
1441 unsigned char opwd[2048];
1442 unsigned char upwd[2048];
1443 size_t opwdlen, upwdlen;
1444
1445 crypt = fz_malloc_struct(ctx, pdf_crypt);
1446
1447 /* Extract file identifier string */
1448
1449 if (pdf_is_string(ctx, id))
1450 crypt->id = pdf_keep_obj(ctx, id);
1451 else
1452 fz_warn(ctx, "missing file identifier, may not be able to do decryption");
1453
1454 switch (algorithm)
1455 {
1456 case PDF_ENCRYPT_RC4_40:
1457 v = 1; r = 2; method = PDF_CRYPT_RC4; length = 40; break;
1458 case PDF_ENCRYPT_RC4_128:
1459 v = 2; r = 3; method = PDF_CRYPT_RC4; length = 128; break;
1460 case PDF_ENCRYPT_AES_128:
1461 v = 4; r = 4; method = PDF_CRYPT_AESV2; length = 128; break;
1462 case PDF_ENCRYPT_AES_256:
1463 v = 5; r = 6; method = PDF_CRYPT_AESV3; length = 256; break;
1464 default:
1465 fz_throw(ctx, FZ_ERROR_FORMAT, "invalid encryption method");
1466 }
1467
1468 crypt->v = v;
1469 crypt->r = r;
1470 crypt->length = length;
1471 crypt->cf = NULL;
1472 crypt->stmf.method = method;
1473 crypt->stmf.length = length;
1474 crypt->strf.method = method;
1475 crypt->strf.length = length;
1476 crypt->encrypt_metadata = 1;
1477 crypt->p = (permissions & 0xf3c) | 0xfffff0c0;
1478 memset(crypt->o, 0, sizeof (crypt->o));
1479 memset(crypt->u, 0, sizeof (crypt->u));
1480 memset(crypt->oe, 0, sizeof (crypt->oe));
1481 memset(crypt->ue, 0, sizeof (crypt->ue));
1482
1483 if (crypt->r <= 4)
1484 {
1485 pdf_docenc_from_utf8((char *) opwd, opwd_utf8, sizeof opwd);
1486 pdf_docenc_from_utf8((char *) upwd, upwd_utf8, sizeof upwd);
1487 }
1488 else
1489 {
1490 pdf_saslprep_from_utf8((char *) opwd, opwd_utf8, sizeof opwd);
1491 pdf_saslprep_from_utf8((char *) upwd, upwd_utf8, sizeof upwd);
1492 }
1493
1494 opwdlen = strlen((char *) opwd);
1495 upwdlen = strlen((char *) upwd);
1496
1497 if (crypt->r <= 4)
1498 {
1499 pdf_compute_owner_password(ctx, crypt, opwd, opwdlen, upwd, upwdlen, crypt->o);
1500 pdf_compute_user_password(ctx, crypt, upwd, upwdlen, crypt->u);
1501 }
1502 else if (crypt->r == 6)
1503 {
1504 /* 7.6.4.4.1 states that the file encryption key are 256 random bits. */
1505 fz_memrnd(ctx, crypt->key, nelem(crypt->key));
1506
1507 pdf_compute_user_password_r6(ctx, crypt, upwd, upwdlen, crypt->u, crypt->ue);
1508 pdf_compute_owner_password_r6(ctx, crypt, opwd, opwdlen, crypt->o, crypt->oe);
1509 pdf_compute_permissions_r6(ctx, crypt, crypt->perms);
1510 }
1511
1512 return crypt;
1513 }