1#include "mupdf/fitz.h"
2#include "mupdf/pdf.h"
3
4#include <string.h>
5
6enum
7{
8 PDF_CRYPT_NONE,
9 PDF_CRYPT_RC4,
10 PDF_CRYPT_AESV2,
11 PDF_CRYPT_AESV3,
12 PDF_CRYPT_UNKNOWN,
13};
14
15typedef struct pdf_crypt_filter_s pdf_crypt_filter;
16
17struct pdf_crypt_filter_s
18{
19 int method;
20 int length;
21};
22
23struct pdf_crypt_s
24{
25 pdf_obj *id;
26
27 int v;
28 int length;
29 pdf_obj *cf;
30 pdf_crypt_filter stmf;
31 pdf_crypt_filter strf;
32
33 int r;
34 unsigned char o[48];
35 unsigned char u[48];
36 unsigned char oe[32];
37 unsigned char ue[32];
38 unsigned char perms[16];
39 int p;
40 int encrypt_metadata;
41
42 unsigned char key[32]; /* decryption key generated from password */
43};
44
45static void pdf_parse_crypt_filter(fz_context *ctx, pdf_crypt_filter *cf, pdf_crypt *crypt, pdf_obj *name);
46
47/*
48 * Create crypt object for decrypting strings and streams
49 * given the Encryption and ID objects.
50 */
51
52pdf_crypt *
53pdf_new_crypt(fz_context *ctx, pdf_obj *dict, pdf_obj *id)
54{
55 pdf_crypt *crypt;
56 pdf_obj *obj;
57
58 crypt = fz_malloc_struct(ctx, pdf_crypt);
59
60 /* Common to all security handlers (PDF 1.7 table 3.18) */
61
62 obj = pdf_dict_get(ctx, dict, PDF_NAME(Filter));
63 if (!pdf_is_name(ctx, obj))
64 {
65 pdf_drop_crypt(ctx, crypt);
66 fz_throw(ctx, FZ_ERROR_GENERIC, "unspecified encryption handler");
67 }
68 if (!pdf_name_eq(ctx, PDF_NAME(Standard), obj))
69 {
70 pdf_drop_crypt(ctx, crypt);
71 fz_throw(ctx, FZ_ERROR_GENERIC, "unknown encryption handler: '%s'", pdf_to_name(ctx, obj));
72 }
73
74 crypt->v = 0;
75 obj = pdf_dict_get(ctx, dict, PDF_NAME(V));
76 if (pdf_is_int(ctx, obj))
77 crypt->v = pdf_to_int(ctx, obj);
78 if (crypt->v != 0 && crypt->v != 1 && crypt->v != 2 && crypt->v != 4 && crypt->v != 5)
79 {
80 pdf_drop_crypt(ctx, crypt);
81 fz_throw(ctx, FZ_ERROR_GENERIC, "unknown encryption version");
82 }
83
84 /* Standard security handler (PDF 1.7 table 3.19) */
85
86 obj = pdf_dict_get(ctx, dict, PDF_NAME(R));
87 if (pdf_is_int(ctx, obj))
88 crypt->r = pdf_to_int(ctx, obj);
89 else if (crypt->v <= 4)
90 {
91 fz_warn(ctx, "encryption dictionary missing revision value, guessing...");
92 if (crypt->v < 2)
93 crypt->r = 2;
94 else if (crypt->v == 2)
95 crypt->r = 3;
96 else if (crypt->v == 4)
97 crypt->r = 4;
98 }
99 else
100 {
101 pdf_drop_crypt(ctx, crypt);
102 fz_throw(ctx, FZ_ERROR_GENERIC, "encryption dictionary missing version and revision value");
103 }
104 if (crypt->r < 1 || crypt->r > 6)
105 {
106 int r = crypt->r;
107 pdf_drop_crypt(ctx, crypt);
108 fz_throw(ctx, FZ_ERROR_GENERIC, "unknown crypt revision %d", r);
109 }
110
111 obj = pdf_dict_get(ctx, dict, PDF_NAME(O));
112 if (pdf_is_string(ctx, obj) && pdf_to_str_len(ctx, obj) == 32)
113 memcpy(crypt->o, pdf_to_str_buf(ctx, obj), 32);
114 /* /O and /U are supposed to be 48 bytes long for revision 5 and 6, they're often longer, though */
115 else if (crypt->r >= 5 && pdf_is_string(ctx, obj) && pdf_to_str_len(ctx, obj) >= 48)
116 memcpy(crypt->o, pdf_to_str_buf(ctx, obj), 48);
117 else
118 {
119 pdf_drop_crypt(ctx, crypt);
120 fz_throw(ctx, FZ_ERROR_GENERIC, "encryption dictionary missing owner password");
121 }
122
123 obj = pdf_dict_get(ctx, dict, PDF_NAME(U));
124 if (pdf_is_string(ctx, obj) && pdf_to_str_len(ctx, obj) == 32)
125 memcpy(crypt->u, pdf_to_str_buf(ctx, obj), 32);
126 /* /O and /U are supposed to be 48 bytes long for revision 5 and 6, they're often longer, though */
127 else if (crypt->r >= 5 && pdf_is_string(ctx, obj) && pdf_to_str_len(ctx, obj) >= 48)
128 memcpy(crypt->u, pdf_to_str_buf(ctx, obj), 48);
129 else if (pdf_is_string(ctx, obj) && pdf_to_str_len(ctx, obj) < 32)
130 {
131 fz_warn(ctx, "encryption password key too short (%d)", pdf_to_str_len(ctx, obj));
132 memcpy(crypt->u, pdf_to_str_buf(ctx, obj), pdf_to_str_len(ctx, obj));
133 }
134 else
135 {
136 pdf_drop_crypt(ctx, crypt);
137 fz_throw(ctx, FZ_ERROR_GENERIC, "encryption dictionary missing user password");
138 }
139
140 obj = pdf_dict_get(ctx, dict, PDF_NAME(P));
141 if (pdf_is_int(ctx, obj))
142 crypt->p = pdf_to_int(ctx, obj);
143 else
144 {
145 fz_warn(ctx, "encryption dictionary missing permissions");
146 crypt->p = 0xfffffffc;
147 }
148
149 if (crypt->r == 5 || crypt->r == 6)
150 {
151 obj = pdf_dict_get(ctx, dict, PDF_NAME(OE));
152 if (!pdf_is_string(ctx, obj) || pdf_to_str_len(ctx, obj) != 32)
153 {
154 pdf_drop_crypt(ctx, crypt);
155 fz_throw(ctx, FZ_ERROR_GENERIC, "encryption dictionary missing owner encryption key");
156 }
157 memcpy(crypt->oe, pdf_to_str_buf(ctx, obj), 32);
158
159 obj = pdf_dict_get(ctx, dict, PDF_NAME(UE));
160 if (!pdf_is_string(ctx, obj) || pdf_to_str_len(ctx, obj) != 32)
161 {
162 pdf_drop_crypt(ctx, crypt);
163 fz_throw(ctx, FZ_ERROR_GENERIC, "encryption dictionary missing user encryption key");
164 }
165 memcpy(crypt->ue, pdf_to_str_buf(ctx, obj), 32);
166 }
167
168 crypt->encrypt_metadata = 1;
169 obj = pdf_dict_get(ctx, dict, PDF_NAME(EncryptMetadata));
170 if (pdf_is_bool(ctx, obj))
171 crypt->encrypt_metadata = pdf_to_bool(ctx, obj);
172
173 /* Extract file identifier string */
174
175 if (pdf_is_array(ctx, id) && pdf_array_len(ctx, id) == 2)
176 {
177 obj = pdf_array_get(ctx, id, 0);
178 if (pdf_is_string(ctx, obj))
179 crypt->id = pdf_keep_obj(ctx, obj);
180 }
181 else
182 fz_warn(ctx, "missing file identifier, may not be able to do decryption");
183
184 /* Determine encryption key length */
185
186 crypt->length = 40;
187 if (crypt->v == 2 || crypt->v == 4)
188 {
189 obj = pdf_dict_get(ctx, dict, PDF_NAME(Length));
190 if (pdf_is_int(ctx, obj))
191 crypt->length = pdf_to_int(ctx, obj);
192
193 /* work-around for pdf generators that assume length is in bytes */
194 if (crypt->length < 40)
195 crypt->length = crypt->length * 8;
196
197 if (crypt->length % 8 != 0)
198 {
199 pdf_drop_crypt(ctx, crypt);
200 fz_throw(ctx, FZ_ERROR_GENERIC, "invalid encryption key length");
201 }
202 if (crypt->length < 40 || crypt->length > 128)
203 {
204 pdf_drop_crypt(ctx, crypt);
205 fz_throw(ctx, FZ_ERROR_GENERIC, "invalid encryption key length");
206 }
207 }
208
209 if (crypt->v == 5)
210 crypt->length = 256;
211
212 if (crypt->v == 0 || crypt->v == 1 || crypt->v == 2)
213 {
214 crypt->stmf.method = PDF_CRYPT_RC4;
215 crypt->stmf.length = crypt->length;
216
217 crypt->strf.method = PDF_CRYPT_RC4;
218 crypt->strf.length = crypt->length;
219 }
220
221 if (crypt->v == 4 || crypt->v == 5)
222 {
223 crypt->stmf.method = PDF_CRYPT_NONE;
224 crypt->stmf.length = crypt->length;
225
226 crypt->strf.method = PDF_CRYPT_NONE;
227 crypt->strf.length = crypt->length;
228
229 obj = pdf_dict_get(ctx, dict, PDF_NAME(CF));
230 if (pdf_is_dict(ctx, obj))
231 {
232 crypt->cf = pdf_keep_obj(ctx, obj);
233 }
234 else
235 {
236 crypt->cf = NULL;
237 }
238
239 fz_try(ctx)
240 {
241 obj = pdf_dict_get(ctx, dict, PDF_NAME(StmF));
242 if (pdf_is_name(ctx, obj))
243 pdf_parse_crypt_filter(ctx, &crypt->stmf, crypt, obj);
244
245 obj = pdf_dict_get(ctx, dict, PDF_NAME(StrF));
246 if (pdf_is_name(ctx, obj))
247 pdf_parse_crypt_filter(ctx, &crypt->strf, crypt, obj);
248 }
249 fz_catch(ctx)
250 {
251 pdf_drop_crypt(ctx, crypt);
252 fz_rethrow(ctx);
253 }
254
255 /* in crypt revision 4, the crypt filter determines the key length */
256 if (crypt->strf.method != PDF_CRYPT_NONE)
257 crypt->length = crypt->stmf.length;
258 }
259
260 return crypt;
261}
262
263void
264pdf_drop_crypt(fz_context *ctx, pdf_crypt *crypt)
265{
266 if (!crypt)
267 return;
268
269 pdf_drop_obj(ctx, crypt->id);
270 pdf_drop_obj(ctx, crypt->cf);
271 fz_free(ctx, crypt);
272}
273
274/*
275 * Parse a CF dictionary entry (PDF 1.7 table 3.22)
276 */
277
278static void
279pdf_parse_crypt_filter(fz_context *ctx, pdf_crypt_filter *cf, pdf_crypt *crypt, pdf_obj *name)
280{
281 pdf_obj *obj;
282 pdf_obj *dict;
283 int is_identity = (pdf_name_eq(ctx, name, PDF_NAME(Identity)));
284 int is_stdcf = (!is_identity && pdf_name_eq(ctx, name, PDF_NAME(StdCF)));
285
286 if (!is_identity && !is_stdcf)
287 fz_throw(ctx, FZ_ERROR_GENERIC, "Crypt Filter not Identity or StdCF (%d 0 R)", pdf_to_num(ctx, crypt->cf));
288
289 cf->method = PDF_CRYPT_NONE;
290 cf->length = crypt->length;
291
292 if (!crypt->cf)
293 {
294 cf->method = (is_identity ? PDF_CRYPT_NONE : PDF_CRYPT_RC4);
295 return;
296 }
297
298 dict = pdf_dict_get(ctx, crypt->cf, name);
299 if (pdf_is_dict(ctx, dict))
300 {
301 obj = pdf_dict_get(ctx, dict, PDF_NAME(CFM));
302 if (pdf_is_name(ctx, obj))
303 {
304 if (pdf_name_eq(ctx, PDF_NAME(None), obj))
305 cf->method = PDF_CRYPT_NONE;
306 else if (pdf_name_eq(ctx, PDF_NAME(V2), obj))
307 cf->method = PDF_CRYPT_RC4;
308 else if (pdf_name_eq(ctx, PDF_NAME(AESV2), obj))
309 cf->method = PDF_CRYPT_AESV2;
310 else if (pdf_name_eq(ctx, PDF_NAME(AESV3), obj))
311 cf->method = PDF_CRYPT_AESV3;
312 else
313 fz_warn(ctx, "unknown encryption method: %s", pdf_to_name(ctx, obj));
314 }
315
316 obj = pdf_dict_get(ctx, dict, PDF_NAME(Length));
317 if (pdf_is_int(ctx, obj))
318 cf->length = pdf_to_int(ctx, obj);
319 }
320 else if (!is_identity)
321 fz_throw(ctx, FZ_ERROR_GENERIC, "cannot parse crypt filter (%d 0 R)", pdf_to_num(ctx, crypt->cf));
322
323 /* the length for crypt filters is supposed to be in bytes not bits */
324 if (cf->length < 40)
325 cf->length = cf->length * 8;
326
327 if ((cf->length % 8) != 0)
328 fz_throw(ctx, FZ_ERROR_GENERIC, "invalid key length: %d", cf->length);
329
330 if ((crypt->r == 1 || crypt->r == 2 || crypt->r == 3 || crypt->r == 4) &&
331 (cf->length < 40 || cf->length > 128))
332 fz_throw(ctx, FZ_ERROR_GENERIC, "invalid key length: %d", cf->length);
333 if ((crypt->r == 5 || crypt->r == 6) && cf->length != 256)
334 fz_throw(ctx, FZ_ERROR_GENERIC, "invalid key length: %d", cf->length);
335}
336
337/*
338 * Compute an encryption key (PDF 1.7 algorithm 3.2)
339 */
340
341static const unsigned char padding[32] =
342{
343 0x28, 0xbf, 0x4e, 0x5e, 0x4e, 0x75, 0x8a, 0x41,
344 0x64, 0x00, 0x4e, 0x56, 0xff, 0xfa, 0x01, 0x08,
345 0x2e, 0x2e, 0x00, 0xb6, 0xd0, 0x68, 0x3e, 0x80,
346 0x2f, 0x0c, 0xa9, 0xfe, 0x64, 0x53, 0x69, 0x7a
347};
348
349static void
350pdf_compute_encryption_key(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen, unsigned char *key)
351{
352 unsigned char buf[32];
353 unsigned int p;
354 int i, n;
355 fz_md5 md5;
356
357 n = fz_clampi(crypt->length / 8, 0, 16);
358
359 /* Step 1 - copy and pad password string */
360 if (pwlen > 32)
361 pwlen = 32;
362 memcpy(buf, password, pwlen);
363 memcpy(buf + pwlen, padding, 32 - pwlen);
364
365 /* Step 2 - init md5 and pass value of step 1 */
366 fz_md5_init(&md5);
367 fz_md5_update(&md5, buf, 32);
368
369 /* Step 3 - pass O value */
370 fz_md5_update(&md5, crypt->o, 32);
371
372 /* Step 4 - pass P value as unsigned int, low-order byte first */
373 p = (unsigned int) crypt->p;
374 buf[0] = (p) & 0xFF;
375 buf[1] = (p >> 8) & 0xFF;
376 buf[2] = (p >> 16) & 0xFF;
377 buf[3] = (p >> 24) & 0xFF;
378 fz_md5_update(&md5, buf, 4);
379
380 /* Step 5 - pass first element of ID array */
381 fz_md5_update(&md5, (unsigned char *)pdf_to_str_buf(ctx, crypt->id), pdf_to_str_len(ctx, crypt->id));
382
383 /* Step 6 (revision 4 or greater) - if metadata is not encrypted pass 0xFFFFFFFF */
384 if (crypt->r >= 4)
385 {
386 if (!crypt->encrypt_metadata)
387 {
388 buf[0] = 0xFF;
389 buf[1] = 0xFF;
390 buf[2] = 0xFF;
391 buf[3] = 0xFF;
392 fz_md5_update(&md5, buf, 4);
393 }
394 }
395
396 /* Step 7 - finish the hash */
397 fz_md5_final(&md5, buf);
398
399 /* Step 8 (revision 3 or greater) - do some voodoo 50 times */
400 if (crypt->r >= 3)
401 {
402 for (i = 0; i < 50; i++)
403 {
404 fz_md5_init(&md5);
405 fz_md5_update(&md5, buf, n);
406 fz_md5_final(&md5, buf);
407 }
408 }
409
410 /* Step 9 - the key is the first 'n' bytes of the result */
411 memcpy(key, buf, n);
412}
413
414/*
415 * Compute an encryption key (PDF 1.7 ExtensionLevel 3 algorithm 3.2a)
416 */
417
418static void
419pdf_compute_encryption_key_r5(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen, int ownerkey, unsigned char *validationkey)
420{
421 unsigned char buffer[128 + 8 + 48];
422 fz_sha256 sha256;
423 fz_aes aes;
424
425 /* Step 2 - truncate UTF-8 password to 127 characters */
426
427 if (pwlen > 127)
428 pwlen = 127;
429
430 /* Step 3/4 - test password against owner/user key and compute encryption key */
431
432 memcpy(buffer, password, pwlen);
433 if (ownerkey)
434 {
435 memcpy(buffer + pwlen, crypt->o + 32, 8);
436 memcpy(buffer + pwlen + 8, crypt->u, 48);
437 }
438 else
439 memcpy(buffer + pwlen, crypt->u + 32, 8);
440
441 fz_sha256_init(&sha256);
442 fz_sha256_update(&sha256, buffer, pwlen + 8 + (ownerkey ? 48 : 0));
443 fz_sha256_final(&sha256, validationkey);
444
445 /* Step 3.5/4.5 - compute file encryption key from OE/UE */
446
447 if (ownerkey)
448 {
449 memcpy(buffer + pwlen, crypt->o + 40, 8);
450 memcpy(buffer + pwlen + 8, crypt->u, 48);
451 }
452 else
453 memcpy(buffer + pwlen, crypt->u + 40, 8);
454
455 fz_sha256_init(&sha256);
456 fz_sha256_update(&sha256, buffer, pwlen + 8 + (ownerkey ? 48 : 0));
457 fz_sha256_final(&sha256, buffer);
458
459 /* clear password buffer and use it as iv */
460 memset(buffer + 32, 0, sizeof(buffer) - 32);
461 if (fz_aes_setkey_dec(&aes, buffer, crypt->length))
462 fz_throw(ctx, FZ_ERROR_GENERIC, "AES key init failed (keylen=%d)", crypt->length);
463 fz_aes_crypt_cbc(&aes, FZ_AES_DECRYPT, 32, buffer + 32, ownerkey ? crypt->oe : crypt->ue, crypt->key);
464}
465
466/*
467 * Compute an encryption key (PDF 1.7 ExtensionLevel 8 algorithm)
468 *
469 * Adobe has not yet released the details, so the algorithm reference is:
470 * http://esec-lab.sogeti.com/post/The-undocumented-password-validation-algorithm-of-Adobe-Reader-X
471 */
472
473static void
474pdf_compute_hardened_hash_r6(fz_context *ctx, unsigned char *password, size_t pwlen, unsigned char salt[8], unsigned char *ownerkey, unsigned char hash[32])
475{
476 unsigned char data[(128 + 64 + 48) * 64];
477 unsigned char block[64];
478 int block_size = 32;
479 size_t data_len = 0;
480 int i, j, sum;
481
482 fz_sha256 sha256;
483 fz_sha384 sha384;
484 fz_sha512 sha512;
485 fz_aes aes;
486
487 /* Step 1: calculate initial data block */
488 fz_sha256_init(&sha256);
489 fz_sha256_update(&sha256, password, pwlen);
490 fz_sha256_update(&sha256, salt, 8);
491 if (ownerkey)
492 fz_sha256_update(&sha256, ownerkey, 48);
493 fz_sha256_final(&sha256, block);
494
495 for (i = 0; i < 64 || i < data[data_len * 64 - 1] + 32; i++)
496 {
497 /* Step 2: repeat password and data block 64 times */
498 memcpy(data, password, pwlen);
499 memcpy(data + pwlen, block, block_size);
500 if (ownerkey)
501 memcpy(data + pwlen + block_size, ownerkey, 48);
502 data_len = pwlen + block_size + (ownerkey ? 48 : 0);
503 for (j = 1; j < 64; j++)
504 memcpy(data + j * data_len, data, data_len);
505
506 /* Step 3: encrypt data using data block as key and iv */
507 if (fz_aes_setkey_enc(&aes, block, 128))
508 fz_throw(ctx, FZ_ERROR_GENERIC, "AES key init failed (keylen=%d)", 128);
509 fz_aes_crypt_cbc(&aes, FZ_AES_ENCRYPT, data_len * 64, block + 16, data, data);
510
511 /* Step 4: determine SHA-2 hash size for this round */
512 for (j = 0, sum = 0; j < 16; j++)
513 sum += data[j];
514
515 /* Step 5: calculate data block for next round */
516 block_size = 32 + (sum % 3) * 16;
517 switch (block_size)
518 {
519 case 32:
520 fz_sha256_init(&sha256);
521 fz_sha256_update(&sha256, data, data_len * 64);
522 fz_sha256_final(&sha256, block);
523 break;
524 case 48:
525 fz_sha384_init(&sha384);
526 fz_sha384_update(&sha384, data, data_len * 64);
527 fz_sha384_final(&sha384, block);
528 break;
529 case 64:
530 fz_sha512_init(&sha512);
531 fz_sha512_update(&sha512, data, data_len * 64);
532 fz_sha512_final(&sha512, block);
533 break;
534 }
535 }
536
537 memset(data, 0, sizeof(data));
538 memcpy(hash, block, 32);
539}
540
541static void
542pdf_compute_encryption_key_r6(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen, int ownerkey, unsigned char *validationkey)
543{
544 unsigned char hash[32];
545 unsigned char iv[16];
546 fz_aes aes;
547
548 if (pwlen > 127)
549 pwlen = 127;
550
551 pdf_compute_hardened_hash_r6(ctx, password, pwlen,
552 (ownerkey ? crypt->o : crypt->u) + 32,
553 ownerkey ? crypt->u : NULL, validationkey);
554 pdf_compute_hardened_hash_r6(ctx, password, pwlen,
555 (ownerkey ? crypt->o : crypt->u) + 40,
556 (ownerkey ? crypt->u : NULL),
557 hash);
558
559 memset(iv, 0, sizeof(iv));
560 if (fz_aes_setkey_dec(&aes, hash, 256))
561 fz_throw(ctx, FZ_ERROR_GENERIC, "AES key init failed (keylen=256)");
562 fz_aes_crypt_cbc(&aes, FZ_AES_DECRYPT, 32, iv, ownerkey ? crypt->oe : crypt->ue, crypt->key);
563}
564
565/*
566 * Computing the user password (PDF 1.7 algorithm 3.4 and 3.5)
567 * Also save the generated key for decrypting objects and streams in crypt->key.
568 */
569
570static void
571pdf_compute_user_password(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen, unsigned char *output)
572{
573 int n = fz_clampi(crypt->length / 8, 0, 16);
574
575 if (crypt->r == 2)
576 {
577 fz_arc4 arc4;
578
579 pdf_compute_encryption_key(ctx, crypt, password, pwlen, crypt->key);
580 fz_arc4_init(&arc4, crypt->key, n);
581 fz_arc4_encrypt(&arc4, output, padding, 32);
582 }
583
584 if (crypt->r == 3 || crypt->r == 4)
585 {
586 unsigned char xor[32];
587 unsigned char digest[16];
588 fz_md5 md5;
589 fz_arc4 arc4;
590 int i, x;
591
592 pdf_compute_encryption_key(ctx, crypt, password, pwlen, crypt->key);
593
594 fz_md5_init(&md5);
595 fz_md5_update(&md5, padding, 32);
596 fz_md5_update(&md5, (unsigned char*)pdf_to_str_buf(ctx, crypt->id), pdf_to_str_len(ctx, crypt->id));
597 fz_md5_final(&md5, digest);
598
599 fz_arc4_init(&arc4, crypt->key, n);
600 fz_arc4_encrypt(&arc4, output, digest, 16);
601
602 for (x = 1; x <= 19; x++)
603 {
604 for (i = 0; i < n; i++)
605 xor[i] = crypt->key[i] ^ x;
606 fz_arc4_init(&arc4, xor, n);
607 fz_arc4_encrypt(&arc4, output, output, 16);
608 }
609
610 memcpy(output + 16, padding, 16);
611 }
612
613 if (crypt->r == 5)
614 {
615 pdf_compute_encryption_key_r5(ctx, crypt, password, pwlen, 0, output);
616 }
617
618 if (crypt->r == 6)
619 {
620 pdf_compute_encryption_key_r6(ctx, crypt, password, pwlen, 0, output);
621 }
622}
623
624/*
625 * Authenticating the user password (PDF 1.7 algorithm 3.6
626 * and ExtensionLevel 3 algorithm 3.11)
627 * This also has the side effect of saving a key generated
628 * from the password for decrypting objects and streams.
629 */
630
631static int
632pdf_authenticate_user_password(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen)
633{
634 unsigned char output[32];
635 pdf_compute_user_password(ctx, crypt, password, pwlen, output);
636 if (crypt->r == 2 || crypt->r == 5 || crypt->r == 6)
637 return memcmp(output, crypt->u, 32) == 0;
638 if (crypt->r == 3 || crypt->r == 4)
639 return memcmp(output, crypt->u, 16) == 0;
640 return 0;
641}
642
643/*
644 * Authenticating the owner password (PDF 1.7 algorithm 3.7,
645 * ExtensionLevel 3 algorithm 3.12, ExtensionLevel 8 algorithm)
646 * Generates the user password from the owner password
647 * and calls pdf_authenticate_user_password.
648 */
649
650static int
651pdf_authenticate_owner_password(fz_context *ctx, pdf_crypt *crypt, unsigned char *ownerpass, size_t pwlen)
652{
653 int n = fz_clampi(crypt->length / 8, 0, 16);
654
655 if (crypt->r == 2)
656 {
657 unsigned char pwbuf[32];
658 unsigned char key[16];
659 unsigned char userpass[32];
660 fz_md5 md5;
661 fz_arc4 arc4;
662
663 if (pwlen > 32)
664 pwlen = 32;
665 memcpy(pwbuf, ownerpass, pwlen);
666 memcpy(pwbuf + pwlen, padding, 32 - pwlen);
667
668 fz_md5_init(&md5);
669 fz_md5_update(&md5, pwbuf, 32);
670 fz_md5_final(&md5, key);
671
672 fz_arc4_init(&arc4, key, n);
673 fz_arc4_encrypt(&arc4, userpass, crypt->o, 32);
674
675 return pdf_authenticate_user_password(ctx, crypt, userpass, 32);
676 }
677
678 if (crypt->r == 3 || crypt->r == 4)
679 {
680 unsigned char pwbuf[32];
681 unsigned char key[16];
682 unsigned char xor[32];
683 unsigned char userpass[32];
684 int i, x;
685 fz_md5 md5;
686 fz_arc4 arc4;
687
688 if (pwlen > 32)
689 pwlen = 32;
690 memcpy(pwbuf, ownerpass, pwlen);
691 memcpy(pwbuf + pwlen, padding, 32 - pwlen);
692
693 fz_md5_init(&md5);
694 fz_md5_update(&md5, pwbuf, 32);
695 fz_md5_final(&md5, key);
696
697 for (i = 0; i < 50; i++)
698 {
699 fz_md5_init(&md5);
700 fz_md5_update(&md5, key, n);
701 fz_md5_final(&md5, key);
702 }
703
704 memcpy(userpass, crypt->o, 32);
705 for (x = 0; x < 20; x++)
706 {
707 for (i = 0; i < n; i++)
708 xor[i] = key[i] ^ (19 - x);
709 fz_arc4_init(&arc4, xor, n);
710 fz_arc4_encrypt(&arc4, userpass, userpass, 32);
711 }
712
713 return pdf_authenticate_user_password(ctx, crypt, userpass, 32);
714 }
715
716 if (crypt->r == 5)
717 {
718 unsigned char key[32];
719 pdf_compute_encryption_key_r5(ctx, crypt, ownerpass, pwlen, 1, key);
720 return !memcmp(key, crypt->o, 32);
721 }
722
723 if (crypt->r == 6)
724 {
725 unsigned char key[32];
726 pdf_compute_encryption_key_r6(ctx, crypt, ownerpass, pwlen, 1, key);
727 return !memcmp(key, crypt->o, 32);
728 }
729
730 return 0;
731}
732
733static void pdf_docenc_from_utf8(char *password, const char *utf8, int n)
734{
735 int i = 0, k, c;
736 while (*utf8 && i + 1 < n)
737 {
738 utf8 += fz_chartorune(&c, utf8);
739 for (k = 0; k < 256; k++)
740 {
741 if (c == fz_unicode_from_pdf_doc_encoding[k])
742 {
743 password[i++] = k;
744 break;
745 }
746 }
747 /* FIXME: drop characters that can't be encoded or return an error? */
748 }
749 password[i] = 0;
750}
751
752static void pdf_saslprep_from_utf8(char *password, const char *utf8, int n)
753{
754 /* TODO: stringprep with SALSprep profile */
755 fz_strlcpy(password, utf8, n);
756}
757
758/*
759 Attempt to authenticate a
760 password.
761
762 Returns 0 for failure, non-zero for success.
763
764 In the non-zero case:
765 bit 0 set => no password required
766 bit 1 set => user password authenticated
767 bit 2 set => owner password authenticated
768*/
769int
770pdf_authenticate_password(fz_context *ctx, pdf_document *doc, const char *pwd_utf8)
771{
772 char password[2048];
773 int auth;
774
775 if (!doc->crypt)
776 return 1; /* No password required */
777
778 password[0] = 0;
779 if (pwd_utf8)
780 {
781 if (doc->crypt->r <= 4)
782 pdf_docenc_from_utf8(password, pwd_utf8, sizeof password);
783 else
784 pdf_saslprep_from_utf8(password, pwd_utf8, sizeof password);
785 }
786
787 auth = 0;
788 if (pdf_authenticate_user_password(ctx, doc->crypt, (unsigned char *)password, strlen(password)))
789 auth = 2;
790 if (pdf_authenticate_owner_password(ctx, doc->crypt, (unsigned char *)password, strlen(password)))
791 auth |= 4;
792 else if (auth & 2)
793 {
794 /* We need to reauthenticate the user password,
795 * because the failed attempt to authenticate
796 * the owner password will have invalidated the
797 * stored keys. */
798 (void)pdf_authenticate_user_password(ctx, doc->crypt, (unsigned char *)password, strlen(password));
799 }
800
801 /* To match Acrobat, we choose not to allow an empty owner
802 * password, unless the user password is also the empty one. */
803 if (*password == 0 && auth == 4)
804 return 0;
805
806 return auth;
807}
808
809int
810pdf_needs_password(fz_context *ctx, pdf_document *doc)
811{
812 if (!doc->crypt)
813 return 0;
814 if (pdf_authenticate_password(ctx, doc, ""))
815 return 0;
816 return 1;
817}
818
819int
820pdf_has_permission(fz_context *ctx, pdf_document *doc, fz_permission p)
821{
822 if (!doc->crypt)
823 return 1;
824 switch (p)
825 {
826 case FZ_PERMISSION_PRINT: return doc->crypt->p & PDF_PERM_PRINT;
827 case FZ_PERMISSION_COPY: return doc->crypt->p & PDF_PERM_COPY;
828 case FZ_PERMISSION_EDIT: return doc->crypt->p & PDF_PERM_MODIFY;
829 case FZ_PERMISSION_ANNOTATE: return doc->crypt->p & PDF_PERM_ANNOTATE;
830 }
831 return 1;
832}
833
834int
835pdf_document_permissions(fz_context *ctx, pdf_document *doc)
836{
837 if (doc->crypt)
838 return doc->crypt->p;
839 /* all permissions granted, reserved bits set appropriately */
840 return (int)0xFFFFFFFC;
841}
842
843/*
844 * Compute the owner password (PDF 1.7 algorithm 3.3)
845 */
846
847static void
848pdf_compute_owner_password(fz_context *ctx, pdf_crypt *crypt, unsigned char *opassword, size_t opwlen, unsigned char *upassword, size_t upwlen, unsigned char *output)
849{
850 unsigned char obuf[32];
851 unsigned char ubuf[32];
852 unsigned char digest[32];
853 int i, n;
854 fz_md5 md5;
855 fz_arc4 arc4;
856
857 n = fz_clampi(crypt->length / 8, 0, 16);
858
859 /* Step 1 - copy and pad owner password string */
860 if (opwlen > 32)
861 opwlen = 32;
862 memcpy(obuf, opassword, opwlen);
863 memcpy(obuf + opwlen, padding, 32 - opwlen);
864
865 /* Step 2 - init md5 and pass value of step 1 */
866 fz_md5_init(&md5);
867 fz_md5_update(&md5, obuf, 32);
868 fz_md5_final(&md5, obuf);
869
870 /* Step 3 (revision 3 or greater) - do some voodoo 50 times */
871 if (crypt->r >= 3)
872 {
873 for (i = 0; i < 50; i++)
874 {
875 fz_md5_init(&md5);
876 fz_md5_update(&md5, obuf, n);
877 fz_md5_final(&md5, obuf);
878 }
879 }
880
881 /* Step 4 - encrypt owner password md5 hash */
882 fz_arc4_init(&arc4, obuf, n);
883
884 /* Step 5 - copy and pad user password string */
885 if (upwlen > 32)
886 upwlen = 32;
887 memcpy(ubuf, upassword, upwlen);
888 memcpy(ubuf + upwlen, padding, 32 - upwlen);
889
890 /* Step 6 - encrypt user password md5 hash */
891 fz_arc4_encrypt(&arc4, digest, ubuf, 32);
892
893 /* Step 7 - */
894 if (crypt->r >= 3)
895 {
896 unsigned char xor[32];
897 int x;
898
899 for (x = 1; x <= 19; x++)
900 {
901 for (i = 0; i < n; i++)
902 xor[i] = obuf[i] ^ x;
903 fz_arc4_init(&arc4, xor, n);
904 fz_arc4_encrypt(&arc4, digest, digest, 32);
905 }
906 }
907
908 /* Step 8 - the owner password is the first 16 bytes of the result */
909 memcpy(output, digest, 32);
910}
911
912unsigned char *
913pdf_crypt_key(fz_context *ctx, pdf_crypt *crypt)
914{
915 if (crypt)
916 return crypt->key;
917 return NULL;
918}
919
920int
921pdf_crypt_version(fz_context *ctx, pdf_crypt *crypt)
922{
923 if (crypt)
924 return crypt->v;
925 return 0;
926}
927
928int pdf_crypt_revision(fz_context *ctx, pdf_crypt *crypt)
929{
930 if (crypt)
931 return crypt->r;
932 return 0;
933}
934
935char *
936pdf_crypt_method(fz_context *ctx, pdf_crypt *crypt)
937{
938 if (crypt)
939 {
940 switch (crypt->strf.method)
941 {
942 case PDF_CRYPT_NONE: return "None";
943 case PDF_CRYPT_RC4: return "RC4";
944 case PDF_CRYPT_AESV2: return "AES";
945 case PDF_CRYPT_AESV3: return "AES";
946 case PDF_CRYPT_UNKNOWN: return "Unknown";
947 }
948 }
949 return "None";
950}
951
952int
953pdf_crypt_length(fz_context *ctx, pdf_crypt *crypt)
954{
955 if (crypt)
956 return crypt->length;
957 return 0;
958}
959
960int
961pdf_crypt_permissions(fz_context *ctx, pdf_crypt *crypt)
962{
963 if (crypt)
964 return crypt->p;
965 return 0;
966}
967
968int
969pdf_crypt_encrypt_metadata(fz_context *ctx, pdf_crypt *crypt)
970{
971 if (crypt)
972 return crypt->encrypt_metadata;
973 return 0;
974}
975
976unsigned char *
977pdf_crypt_owner_password(fz_context *ctx, pdf_crypt *crypt)
978{
979 if (crypt)
980 return crypt->o;
981 return NULL;
982}
983
984unsigned char *
985pdf_crypt_user_password(fz_context *ctx, pdf_crypt *crypt)
986{
987 if (crypt)
988 return crypt->u;
989 return NULL;
990}
991
992unsigned char *
993pdf_crypt_owner_encryption(fz_context *ctx, pdf_crypt *crypt)
994{
995 if (crypt)
996 return crypt->oe;
997 return NULL;
998}
999
1000unsigned char *
1001pdf_crypt_user_encryption(fz_context *ctx, pdf_crypt *crypt)
1002{
1003 if (crypt)
1004 return crypt->ue;
1005 return NULL;
1006}
1007
1008unsigned char *
1009pdf_crypt_permissions_encryption(fz_context *ctx, pdf_crypt *crypt)
1010{
1011 if (crypt)
1012 return crypt->perms;
1013 return 0;
1014}
1015
1016/*
1017 * PDF 1.7 algorithm 3.1 and ExtensionLevel 3 algorithm 3.1a
1018 *
1019 * Using the global encryption key that was generated from the
1020 * password, create a new key that is used to decrypt individual
1021 * objects and streams. This key is based on the object and
1022 * generation numbers.
1023 */
1024
1025static int
1026pdf_compute_object_key(pdf_crypt *crypt, pdf_crypt_filter *cf, int num, int gen, unsigned char *key, int max_len)
1027{
1028 fz_md5 md5;
1029 unsigned char message[5];
1030 int key_len = crypt->length / 8;
1031
1032 if (key_len > max_len)
1033 key_len = max_len;
1034
1035 /* Encryption method version 0 is undocumented, but a lucky
1036 guess revealed that all streams/strings in those PDFs are
1037 encrypted using the same 40 bit file enryption key using RC4. */
1038 if (crypt->v == 0 || cf->method == PDF_CRYPT_AESV3)
1039 {
1040 memcpy(key, crypt->key, key_len);
1041 return key_len;
1042 }
1043
1044 fz_md5_init(&md5);
1045 fz_md5_update(&md5, crypt->key, key_len);
1046 message[0] = (num) & 0xFF;
1047 message[1] = (num >> 8) & 0xFF;
1048 message[2] = (num >> 16) & 0xFF;
1049 message[3] = (gen) & 0xFF;
1050 message[4] = (gen >> 8) & 0xFF;
1051 fz_md5_update(&md5, message, 5);
1052
1053 if (cf->method == PDF_CRYPT_AESV2)
1054 fz_md5_update(&md5, (unsigned char *)"sAlT", 4);
1055
1056 fz_md5_final(&md5, key);
1057
1058 if (key_len + 5 > 16)
1059 return 16;
1060 return key_len + 5;
1061}
1062
1063/*
1064 * PDF 1.7 algorithm 3.1 and ExtensionLevel 3 algorithm 3.1a
1065 *
1066 * Decrypt all strings in obj modifying the data in-place.
1067 * Recurse through arrays and dictionaries, but do not follow
1068 * indirect references.
1069 */
1070
1071static void
1072pdf_crypt_obj_imp(fz_context *ctx, pdf_crypt *crypt, pdf_obj *obj, unsigned char *key, int keylen)
1073{
1074 unsigned char *s;
1075 int i, n;
1076
1077 if (pdf_is_indirect(ctx, obj))
1078 return;
1079
1080 if (pdf_is_string(ctx, obj))
1081 {
1082 s = (unsigned char *)pdf_to_str_buf(ctx, obj);
1083 n = pdf_to_str_len(ctx, obj);
1084
1085 if (crypt->strf.method == PDF_CRYPT_RC4)
1086 {
1087 fz_arc4 arc4;
1088 fz_arc4_init(&arc4, key, keylen);
1089 fz_arc4_encrypt(&arc4, s, s, n);
1090 }
1091
1092 if (crypt->strf.method == PDF_CRYPT_AESV2 || crypt->strf.method == PDF_CRYPT_AESV3)
1093 {
1094 if (n == 0)
1095 {
1096 /* Empty strings are permissible */
1097 }
1098 else if (n & 15 || n < 32)
1099 fz_warn(ctx, "invalid string length for aes encryption");
1100 else
1101 {
1102 unsigned char iv[16];
1103 fz_aes aes;
1104 memcpy(iv, s, 16);
1105 if (fz_aes_setkey_dec(&aes, key, keylen * 8))
1106 fz_throw(ctx, FZ_ERROR_GENERIC, "AES key init failed (keylen=%d)", keylen * 8);
1107 fz_aes_crypt_cbc(&aes, FZ_AES_DECRYPT, n - 16, iv, s + 16, s);
1108 /* delete space used for iv and padding bytes at end */
1109 if (s[n - 17] < 1 || s[n - 17] > 16)
1110 fz_warn(ctx, "aes padding out of range");
1111 else
1112 pdf_set_str_len(ctx, obj, n - 16 - s[n - 17]);
1113 }
1114 }
1115 }
1116
1117 else if (pdf_is_array(ctx, obj))
1118 {
1119 n = pdf_array_len(ctx, obj);
1120 for (i = 0; i < n; i++)
1121 {
1122 pdf_crypt_obj_imp(ctx, crypt, pdf_array_get(ctx, obj, i), key, keylen);
1123 }
1124 }
1125
1126 else if (pdf_is_dict(ctx, obj))
1127 {
1128 n = pdf_dict_len(ctx, obj);
1129 for (i = 0; i < n; i++)
1130 {
1131 pdf_crypt_obj_imp(ctx, crypt, pdf_dict_get_val(ctx, obj, i), key, keylen);
1132 }
1133 }
1134}
1135
1136void
1137pdf_crypt_obj(fz_context *ctx, pdf_crypt *crypt, pdf_obj *obj, int num, int gen)
1138{
1139 unsigned char key[32];
1140 int len;
1141
1142 len = pdf_compute_object_key(crypt, &crypt->strf, num, gen, key, 32);
1143
1144 pdf_crypt_obj_imp(ctx, crypt, obj, key, len);
1145}
1146
1147/*
1148 * PDF 1.7 algorithm 3.1 and ExtensionLevel 3 algorithm 3.1a
1149 *
1150 * Create filter suitable for de/encrypting a stream.
1151 */
1152static fz_stream *
1153pdf_open_crypt_imp(fz_context *ctx, fz_stream *chain, pdf_crypt *crypt, pdf_crypt_filter *stmf, int num, int gen)
1154{
1155 unsigned char key[32];
1156 int len;
1157
1158 len = pdf_compute_object_key(crypt, stmf, num, gen, key, 32);
1159
1160 if (stmf->method == PDF_CRYPT_RC4)
1161 return fz_open_arc4(ctx, chain, key, len);
1162
1163 if (stmf->method == PDF_CRYPT_AESV2 || stmf->method == PDF_CRYPT_AESV3)
1164 return fz_open_aesd(ctx, chain, key, len);
1165
1166 return fz_keep_stream(ctx, chain);
1167}
1168
1169fz_stream *
1170pdf_open_crypt(fz_context *ctx, fz_stream *chain, pdf_crypt *crypt, int num, int gen)
1171{
1172 return pdf_open_crypt_imp(ctx, chain, crypt, &crypt->stmf, num, gen);
1173}
1174
1175fz_stream *
1176pdf_open_crypt_with_filter(fz_context *ctx, fz_stream *chain, pdf_crypt *crypt, pdf_obj *name, int num, int gen)
1177{
1178 if (!pdf_name_eq(ctx, name, PDF_NAME(Identity)))
1179 {
1180 pdf_crypt_filter cf;
1181 pdf_parse_crypt_filter(ctx, &cf, crypt, name);
1182 return pdf_open_crypt_imp(ctx, chain, crypt, &cf, num, gen);
1183 }
1184 return fz_keep_stream(ctx, chain);
1185}
1186
1187void
1188pdf_print_crypt(fz_context *ctx, fz_output *out, pdf_crypt *crypt)
1189{
1190 int i;
1191
1192 fz_write_printf(ctx, out, "crypt {\n");
1193
1194 fz_write_printf(ctx, out, "\tv=%d length=%d\n", crypt->v, crypt->length);
1195 fz_write_printf(ctx, out, "\tstmf method=%d length=%d\n", crypt->stmf.method, crypt->stmf.length);
1196 fz_write_printf(ctx, out, "\tstrf method=%d length=%d\n", crypt->strf.method, crypt->strf.length);
1197 fz_write_printf(ctx, out, "\tr=%d\n", crypt->r);
1198
1199 fz_write_printf(ctx, out, "\to=<");
1200 for (i = 0; i < 32; i++)
1201 fz_write_printf(ctx, out, "%02X", crypt->o[i]);
1202 fz_write_printf(ctx, out, ">\n");
1203
1204 fz_write_printf(ctx, out, "\tu=<");
1205 for (i = 0; i < 32; i++)
1206 fz_write_printf(ctx, out, "%02X", crypt->u[i]);
1207 fz_write_printf(ctx, out, ">\n");
1208
1209 fz_write_printf(ctx, out, "}\n");
1210}
1211
1212void pdf_encrypt_data(fz_context *ctx, pdf_crypt *crypt, int num, int gen, void (*write_data)(fz_context *ctx, void *, const unsigned char *, int), void *arg, const unsigned char *s, int n)
1213{
1214 unsigned char buffer[256];
1215 unsigned char key[32];
1216 int keylen;
1217
1218 if (crypt == NULL)
1219 {
1220 write_data(ctx, arg, s, n);
1221 return;
1222 }
1223
1224 keylen = pdf_compute_object_key(crypt, &crypt->strf, num, gen, key, 32);
1225
1226 if (crypt->strf.method == PDF_CRYPT_RC4)
1227 {
1228 fz_arc4 arc4;
1229 fz_arc4_init(&arc4, key, keylen);
1230 while (n > 0)
1231 {
1232 int len = n;
1233 if (len > sizeof(buffer))
1234 len = sizeof(buffer);
1235 fz_arc4_encrypt(&arc4, buffer, s, len);
1236 write_data(ctx, arg, buffer, len);
1237 s += len;
1238 n -= len;
1239 }
1240 return;
1241 }
1242
1243 if (crypt->strf.method == PDF_CRYPT_AESV2 || crypt->strf.method == PDF_CRYPT_AESV3)
1244 {
1245 fz_aes aes;
1246 unsigned char iv[16];
1247
1248 /* Empty strings can be represented by empty strings */
1249 if (n == 0)
1250 return;
1251
1252 if (fz_aes_setkey_enc(&aes, key, keylen * 8))
1253 fz_throw(ctx, FZ_ERROR_GENERIC, "AES key init failed (keylen=%d)", keylen * 8);
1254
1255 fz_memrnd(ctx, iv, 16);
1256 write_data(ctx, arg, iv, 16);
1257
1258 while (n > 0)
1259 {
1260 int len = n;
1261 if (len > 16)
1262 len = 16;
1263 memcpy(buffer, s, len);
1264 if (len != 16)
1265 memset(&buffer[len], 16-len, 16-len);
1266 fz_aes_crypt_cbc(&aes, FZ_AES_ENCRYPT, 16, iv, buffer, buffer+16);
1267 write_data(ctx, arg, buffer+16, 16);
1268 s += 16;
1269 n -= 16;
1270 }
1271 if (n == 0) {
1272 memset(buffer, 16, 16);
1273 fz_aes_crypt_cbc(&aes, FZ_AES_ENCRYPT, 16, iv, buffer, buffer+16);
1274 write_data(ctx, arg, buffer+16, 16);
1275 }
1276 return;
1277 }
1278
1279 /* Should never happen, but... */
1280 write_data(ctx, arg, s, n);
1281}
1282
1283int pdf_encrypted_len(fz_context *ctx, pdf_crypt *crypt, int num, int gen, int len)
1284{
1285 if (crypt == NULL)
1286 return len;
1287
1288 if (crypt->strf.method == PDF_CRYPT_AESV2 || crypt->strf.method == PDF_CRYPT_AESV3)
1289 {
1290 len += 16; /* 16 for IV */
1291 if ((len & 15) == 0)
1292 len += 16; /* Another 16 if our last block is full anyway */
1293 len = (len + 15) & ~15; /* And pad to the block */
1294 }
1295
1296 return len;
1297}
1298
1299/* PDF 2.0 algorithm 8 */
1300static void
1301pdf_compute_user_password_r6(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen, unsigned char *outputpw, unsigned char *outputencryption)
1302{
1303 unsigned char validationsalt[8];
1304 unsigned char keysalt[8];
1305 unsigned char hash[32];
1306 unsigned char iv[16];
1307 fz_aes aes;
1308
1309 /* Step a) - Generate random salts. */
1310 fz_memrnd(ctx, validationsalt, nelem(validationsalt));
1311 fz_memrnd(ctx, keysalt, nelem(keysalt));
1312
1313 /* Step a) - Compute 32 byte hash given password and validation salt. */
1314 pdf_compute_hardened_hash_r6(ctx, password, pwlen, validationsalt, NULL, outputpw);
1315 memcpy(outputpw + 32, validationsalt, nelem(validationsalt));
1316 memcpy(outputpw + 40, keysalt, nelem(keysalt));
1317
1318 /* Step b) - Compute 32 byte hash given password and user salt. */
1319 pdf_compute_hardened_hash_r6(ctx, password, pwlen, keysalt, NULL, hash);
1320
1321 /* Step b) - Use hash as AES-key when encrypting the file encryption key. */
1322 memset(iv, 0, sizeof(iv));
1323 if (fz_aes_setkey_enc(&aes, hash, 256))
1324 fz_throw(ctx, FZ_ERROR_GENERIC, "AES key init failed (keylen=256)");
1325 fz_aes_crypt_cbc(&aes, FZ_AES_ENCRYPT, 32, iv, crypt->key, outputencryption);
1326}
1327
1328/* PDF 2.0 algorithm 9 */
1329static void
1330pdf_compute_owner_password_r6(fz_context *ctx, pdf_crypt *crypt, unsigned char *password, size_t pwlen, unsigned char *outputpw, unsigned char *outputencryption)
1331{
1332 unsigned char validationsalt[8];
1333 unsigned char keysalt[8];
1334 unsigned char hash[32];
1335 unsigned char iv[16];
1336 fz_aes aes;
1337
1338 /* Step a) - Generate random salts. */
1339 fz_memrnd(ctx, validationsalt, nelem(validationsalt));
1340 fz_memrnd(ctx, keysalt, nelem(keysalt));
1341
1342 /* Step a) - Compute 32 byte hash given owner password, validation salt and user password. */
1343 pdf_compute_hardened_hash_r6(ctx, password, pwlen, validationsalt, crypt->u, outputpw);
1344 memcpy(outputpw + 32, validationsalt, nelem(validationsalt));
1345 memcpy(outputpw + 40, keysalt, nelem(keysalt));
1346
1347 /* Step b) - Compute 32 byte hash given owner password, user salt and user password. */
1348 pdf_compute_hardened_hash_r6(ctx, password, pwlen, keysalt, crypt->u, hash);
1349
1350 /* Step b) - Use hash as AES-key when encrypting the file encryption key. */
1351 memset(iv, 0, sizeof(iv));
1352 if (fz_aes_setkey_enc(&aes, hash, 256))
1353 fz_throw(ctx, FZ_ERROR_GENERIC, "AES key init failed (keylen=256)");
1354 fz_aes_crypt_cbc(&aes, FZ_AES_ENCRYPT, 32, iv, crypt->key, outputencryption);
1355}
1356
1357/* PDF 2.0 algorithm 10 */
1358static void
1359pdf_compute_permissions_r6(fz_context *ctx, pdf_crypt *crypt, unsigned char *output)
1360{
1361 unsigned char buf[16];
1362 unsigned char iv[16];
1363 fz_aes aes;
1364
1365 /* Steps a) and b) - Extend permissions field and put into lower order bytes. */
1366 memcpy(buf, (unsigned char *) &crypt->p, 4);
1367 memset(&buf[4], 0xff, 4);
1368
1369 /* Step c) - Encode EncryptMetadata as T/F. */
1370 buf[8] = crypt->encrypt_metadata ? 'T' : 'F';
1371
1372 /* Step d) - Encode ASCII characters "adb". */
1373 buf[9] = 'a';
1374 buf[10] = 'd';
1375 buf[11] = 'b';
1376
1377 /* Step e) - Encode 4 random bytes. */
1378 fz_memrnd(ctx, &buf[12], 4);
1379
1380 /* Step f) - Use file encryption key as AES-key when encrypting buffer. */
1381 memset(iv, 0, sizeof(iv));
1382 if (fz_aes_setkey_enc(&aes, crypt->key, 256))
1383 fz_throw(ctx, FZ_ERROR_GENERIC, "AES key init failed (keylen=256)");
1384 fz_aes_crypt_cbc(&aes, FZ_AES_ENCRYPT, 16, iv, buf, output);
1385}
1386
1387pdf_crypt *
1388pdf_new_encrypt(fz_context *ctx, const char *opwd_utf8, const char *upwd_utf8, pdf_obj *id, int permissions, int algorithm)
1389{
1390 pdf_crypt *crypt;
1391 int v, r, method, length;
1392 unsigned char opwd[2048];
1393 unsigned char upwd[2048];
1394 size_t opwdlen, upwdlen;
1395
1396 crypt = fz_malloc_struct(ctx, pdf_crypt);
1397
1398 /* Extract file identifier string */
1399
1400 if (pdf_is_string(ctx, id))
1401 crypt->id = pdf_keep_obj(ctx, id);
1402 else
1403 fz_warn(ctx, "missing file identifier, may not be able to do decryption");
1404
1405 switch (algorithm)
1406 {
1407 case PDF_ENCRYPT_RC4_40:
1408 v = 1; r = 2; method = PDF_CRYPT_RC4; length = 40; break;
1409 case PDF_ENCRYPT_RC4_128:
1410 v = 2; r = 3; method = PDF_CRYPT_RC4; length = 128; break;
1411 case PDF_ENCRYPT_AES_128:
1412 v = 4; r = 4; method = PDF_CRYPT_AESV2; length = 128; break;
1413 case PDF_ENCRYPT_AES_256:
1414 v = 5; r = 6; method = PDF_CRYPT_AESV3; length = 256; break;
1415 default:
1416 fz_throw(ctx, FZ_ERROR_GENERIC, "invalid encryption method");
1417 }
1418
1419 crypt->v = v;
1420 crypt->r = r;
1421 crypt->length = length;
1422 crypt->cf = NULL;
1423 crypt->stmf.method = method;
1424 crypt->stmf.length = length;
1425 crypt->strf.method = method;
1426 crypt->strf.length = length;
1427 crypt->encrypt_metadata = 1;
1428 crypt->p = (permissions & 0xf3c) | 0xfffff0c0;
1429 memset(crypt->o, 0, sizeof (crypt->o));
1430 memset(crypt->u, 0, sizeof (crypt->u));
1431 memset(crypt->oe, 0, sizeof (crypt->oe));
1432 memset(crypt->ue, 0, sizeof (crypt->ue));
1433
1434 if (crypt->r <= 4)
1435 {
1436 pdf_docenc_from_utf8((char *) opwd, opwd_utf8, sizeof opwd);
1437 pdf_docenc_from_utf8((char *) upwd, upwd_utf8, sizeof upwd);
1438 }
1439 else
1440 {
1441 pdf_saslprep_from_utf8((char *) opwd, opwd_utf8, sizeof opwd);
1442 pdf_saslprep_from_utf8((char *) upwd, upwd_utf8, sizeof upwd);
1443 }
1444
1445 opwdlen = strlen((char *) opwd);
1446 upwdlen = strlen((char *) upwd);
1447
1448 if (crypt->r <= 4)
1449 {
1450 pdf_compute_owner_password(ctx, crypt, opwd, opwdlen, upwd, upwdlen, crypt->o);
1451 pdf_compute_user_password(ctx, crypt, upwd, upwdlen, crypt->u);
1452 }
1453 else if (crypt->r == 6)
1454 {
1455 /* 7.6.4.4.1 states that the file encryption key are 256 random bits. */
1456 fz_memrnd(ctx, crypt->key, nelem(crypt->key));
1457
1458 pdf_compute_user_password_r6(ctx, crypt, upwd, upwdlen, crypt->u, crypt->ue);
1459 pdf_compute_owner_password_r6(ctx, crypt, opwd, opwdlen, crypt->o, crypt->oe);
1460 pdf_compute_permissions_r6(ctx, crypt, crypt->perms);
1461 }
1462
1463 return crypt;
1464}
1465