On Tuesday 23 January 2007 17:29, Chuck wrote: > TerryJ wrote: > > I'd use top quality software to encrypt a file with some confidence but > > OpenOffice is not in that category. The password might be secure > > (although there's a password cracker on www.ooomacros.org) but the > > encrypting can, it seems, go awry. > > Please tell me this macro is just uses a dictionary attack and assumes > the document was encrypted with a a password susceptible to such > attacks. I'd hate to think that OOo uses some brain-dead encryption > algorithm that can be mathematically reversed.
OK, I've just set a password on an ODT document, unzipped the resulting .odt file, and looked at the files. Assuming the xml in the manifest is truly descriptive, the encryption uses the Blowfish CFB algorithm (http://www.schneier.com/blowfish.html). 5 files are encrypted with different keys, each one derived from the password with PBKDF2 (http://en.wikipedia.org/wiki/PBKDF2) using different salts. The files are: layout-cache, content.xml, styles.xml, thumbnail.png, settings.xml and I would guess that if there are more data files, then these would have been encrypted too, each with their own key. Checking them, they certainly look like random data. If either you do not believe the xml descriptions, or you don't trust the programmers to have done what appears they have, you are free to write your own encryption tool for the resulting document yourself. That's the advantage of open source, you can see what is going on. However, I also noticed that the file meta.xml is not encrypted and it contains various statistics of the document, including its origin, the creation date, the author, and the program that made it. Why this is en clair I don't know, Anyone enlighten me? > > If you're really* concerned about securing a document, encrypt it using > a program that specializes in just that, like pgp or GNUpg, and don't > create a private key for decrypting the files with a weak passphrase. -- Andy Pepperdine On this mailing list help is provided by volunteers. Please subscribe to the mailing list to see all the replies to a query, and reply only to the mailing list. For FAQ, userguide, see: http://documentation.openoffice.org/ --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
