6 ms·

Cracking Encrypted PDFs

140 points by rishabhd 9y ago

Someone 9y ago
So, no matter how good your password, by default they shorten it to a 40-bit key, but they also allow you to override the encryption method? Seems similar to what Office XP and 2003 do (https://en.wikipedia.org/wiki/Microsoft_Office_password_protection#History_of_Microsoft_Encryption_password https://en.wikipedia.org/wiki/Microsoft_Office_password_prot...). Did Adobe and Microsoft design this together?
- sheetjs 9y ago
  Modern versions of Office use stronger encryption methods. Office 2013 and 2016 by default use SHA-512 with AES-256-CBC. Given the constraints when the schemes were first devised, 40-bit represented a reasonable tradeoff given the computing power and understanding at the time.
  - lvh 9y ago
    In case anyone was confused as to how they use SHA-512, it appears they use it for password stretching. (I was unable to find anything about authentication tags, although I guess it's hard to get a chosen ciphertext oracle out of Excel files unless you find a computer consuming them?)
    - blattimwind 9y ago
      I'm not so sure about that, since Excel files are not that unusual to exchange data and some web applications seem to process them automatically on some Windows server. However: these are never encrypted anyway.
      - lvh 9y ago
        Yes, hence "unless you find a computer consuming them" :-)
    - 13of40 9y ago
      IIRC, by default the "agile" encryption scheme in office defaults to producing a key from a password with 100,000 rounds of SHA-512, with each iteration salted with an incrementing integer to prevent loops. It takes about 800ms to compute one key on a newish machine.
      - btown 9y ago
        This is really interesting! https://msdn.microsoft.com/en-us/library/dd924776(v=office.12).aspx https://msdn.microsoft.com/en-us/library/dd924776(v=office.1... seems to be the spec for this. Though I wonder if any vulnerabilities to this type of password stretching scheme have been discovered in the years since.
        blattimwind 9y ago
        That's pretty much just PBKDF1.
- erpellan 9y ago
  I think this article only applies to older PDFs. From what I can tell, PDF2.0 changed the encryption to AES-256. Almost none of the PDF tools the article mentioned can even recognise PDF2.0 https://www.pdflib.com/knowledge-base/pdf-password-security/encryption/ https://www.pdflib.com/knowledge-base/pdf-password-security/...
  - agumonkey 9y ago
    Wasn't even aware that PDF2.0 was out
    - dunham 9y ago
      Neither was I. It appears to have been released around July 2017 as ISO 32000-2:2017.
  - phonon 9y ago
    I don't think there are any PDF 2.0 files "out in the wild" yet. In any case the article is about a 40 bit RC4 key. PDF has supported much much stronger encryption schemes for a very very long time. https://www.pdflib.com/knowledge-base/pdf-password-security/encryption/ https://www.pdflib.com/knowledge-base/pdf-password-security/...
  - deleted 9y ago
    [deleted]
- blattimwind 9y ago
  I believe the various 40-bit encryption schemes from the 90s are based on USG regulation (cryptography export), not the ill-will of the vendors per se. https://en.wikipedia.org/wiki/40-bit_encryption https://en.wikipedia.org/wiki/40-bit_encryption
  - deleted 9y ago
    [deleted]
  - Someone 9y ago
    Makes sense (lots of it). Thanks.
userbinator 9y ago
This reminds me of a large company whose products' datasheets are protected with a password, presumably as an extra layer of security if they get leaked (which they do...) They didn't use the very old 40-bit encryption, but the slightly newer 128-bit RC4, which would theoretically be much harder to crack. However, the password is 10 digits. I used a multithreaded version of PDFcrack[1] and let it run overnight, recovering all of them in a few days. (The irony is, this company probably makes more from the massive design-in and additional product sales enabled by these leaked documents... so I'm not sure if the passwords were deliberately weak, just strong enough to satisfy their legal department but easy for anyone else to get through.) [1] http://andi.flowrider.ch/research/pdfcrack.html http://andi.flowrider.ch/research/pdfcrack.html
- javajosh 9y ago
  You can pick a password in proportion to the threat. A short password is sufficient to thwart "casual attacks" (someone snooping around by accident). You can increase the entropy of the password as needed to thwart arbitrary compute. (Although to get enough entropy you'd probably want to generate a GUID for a password, write it down, and don't lose it.) What I'm trying to say is that your company wasn't necessarily being stupid.

140 points by rishabhd 9y ago

So, no matter how good your password, by default they shorten it to a 40-bit key, but they also allow you to override the encryption method? Seems similar to what Office XP and 2003 do (https://en.wikipedia.org/wiki/Microsoft_Office_password_protection#History_of_Microsoft_Encryption_password https://en.wikipedia.org/wiki/Microsoft_Office_password_prot...). Did Adobe and Microsoft design this together?

sheetjs 9y ago
Modern versions of Office use stronger encryption methods. Office 2013 and 2016 by default use SHA-512 with AES-256-CBC. Given the constraints when the schemes were first devised, 40-bit represented a reasonable tradeoff given the computing power and understanding at the time.
- lvh 9y ago
  In case anyone was confused as to how they use SHA-512, it appears they use it for password stretching. (I was unable to find anything about authentication tags, although I guess it's hard to get a chosen ciphertext oracle out of Excel files unless you find a computer consuming them?)
  - blattimwind 9y ago
    I'm not so sure about that, since Excel files are not that unusual to exchange data and some web applications seem to process them automatically on some Windows server. However: these are never encrypted anyway.
    - lvh 9y ago
      Yes, hence "unless you find a computer consuming them" :-)
  - 13of40 9y ago
    IIRC, by default the "agile" encryption scheme in office defaults to producing a key from a password with 100,000 rounds of SHA-512, with each iteration salted with an incrementing integer to prevent loops. It takes about 800ms to compute one key on a newish machine.
    - btown 9y ago
      This is really interesting! https://msdn.microsoft.com/en-us/library/dd924776(v=office.12).aspx https://msdn.microsoft.com/en-us/library/dd924776(v=office.1... seems to be the spec for this. Though I wonder if any vulnerabilities to this type of password stretching scheme have been discovered in the years since.
      - blattimwind 9y ago
        That's pretty much just PBKDF1.
erpellan 9y ago
I think this article only applies to older PDFs. From what I can tell, PDF2.0 changed the encryption to AES-256. Almost none of the PDF tools the article mentioned can even recognise PDF2.0 https://www.pdflib.com/knowledge-base/pdf-password-security/encryption/ https://www.pdflib.com/knowledge-base/pdf-password-security/...
- agumonkey 9y ago
  Wasn't even aware that PDF2.0 was out
  - dunham 9y ago
    Neither was I. It appears to have been released around July 2017 as ISO 32000-2:2017.
- phonon 9y ago
  I don't think there are any PDF 2.0 files "out in the wild" yet. In any case the article is about a 40 bit RC4 key. PDF has supported much much stronger encryption schemes for a very very long time. https://www.pdflib.com/knowledge-base/pdf-password-security/encryption/ https://www.pdflib.com/knowledge-base/pdf-password-security/...
- deleted 9y ago
  [deleted]
blattimwind 9y ago
I believe the various 40-bit encryption schemes from the 90s are based on USG regulation (cryptography export), not the ill-will of the vendors per se. https://en.wikipedia.org/wiki/40-bit_encryption https://en.wikipedia.org/wiki/40-bit_encryption
- deleted 9y ago
  [deleted]
- Someone 9y ago
  Makes sense (lots of it). Thanks.

userbinator 9y ago

This reminds me of a large company whose products' datasheets are protected with a password, presumably as an extra layer of security if they get leaked (which they do...) They didn't use the very old 40-bit encryption, but the slightly newer 128-bit RC4, which would theoretically be much harder to crack. However, the password is 10 digits. I used a multithreaded version of PDFcrack[1] and let it run overnight, recovering all of them in a few days. (The irony is, this company probably makes more from the massive design-in and additional product sales enabled by these leaked documents... so I'm not sure if the passwords were deliberately weak, just strong enough to satisfy their legal department but easy for anyone else to get through.) [1] http://andi.flowrider.ch/research/pdfcrack.html http://andi.flowrider.ch/research/pdfcrack.html

javajosh 9y ago
You can pick a password in proportion to the threat. A short password is sufficient to thwart "casual attacks" (someone snooping around by accident). You can increase the entropy of the password as needed to thwart arbitrary compute. (Although to get enough entropy you'd probably want to generate a GUID for a password, write it down, and don't lose it.) What I'm trying to say is that your company wasn't necessarily being stupid.