https://bugs.documentfoundation.org/show_bug.cgi?id=174025
Bug ID: 174025
Summary: PDF export with AES-256 encryption (PDF 2.0):
Namespace /NS string is written unencrypted
Product: LibreOffice
Version: 26.8.1.1 release
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: medium
Component: Printing and PDF export
Assignee: [email protected]
Reporter: [email protected]
Created attachment 209141
--> https://bugs.documentfoundation.org/attachment.cgi?id=209141&action=edit
aes256-export.pdf: AES-256 export (open password 'user', permissions password
'owner'); object 1 has the plain-text /NS(http://iso.org/pdf2/ssn)
In a PDF 2.0 export with a password (AES-256), the structure namespace
dictionary is written with its /NS string in plain text:
1 0 obj
<</Type/Namespace/NS(http://iso.org/pdf2/ssn)>>
endobj
With encryption, all strings in indirect objects must be encrypted (ISO 32000-2
7.6.2; the exceptions are the encryption dictionary, the trailer /ID, signature
/Contents and cross-reference streams). A conforming reader decrypts this
string and gets garbage. For AES the 23-byte value can't even be valid
ciphertext: AES output is a multiple of 16 bytes and at least 32 bytes long.
Steps to reproduce:
Same export as bug 174024: export any document (e.g. the repro.html attached
there) to PDF 2.0 with an open password:
soffice --headless --infilter="HTML (StarWriter)" --convert-to
'pdf:writer_pdf_Export:{"SelectPdfVersion":{"type":"long","value":"20"},"EncryptFile":{"type":"boolean","value":"true"},"DocumentOpenPassword":{"type":"string","value":"user"},"RestrictPermissions":{"type":"boolean","value":"true"},"PermissionPassword":{"type":"string","value":"owner"}}'
repro.html
Then look at the Namespace object in the output (it is plain text, e.g. grep -a
"Namespace" repro.pdf).
Actual results:
/NS(http://iso.org/pdf2/ssn) appears in plain text in the encrypted file
(object 1 of the aes256-export.pdf attached to bug 174024; open password
"user").
Expected results:
The /NS string is encrypted like every other string in the document.
Additional information:
Presumably the namespace object is written by a code path that bypasses the
encryption step used for other strings. Found while testing a PDF reader
against encrypted PDFs; LibreOffice 26.8.1.1, macOS 15.8.1. See also bug 174024
(same export, wrong stream /Length).
--
You are receiving this mail because:
You are the assignee for the bug.
