I've been going through the spec but it's still unclear how they protect the "perms" area of the document.  So far, it doesn't look like it's actually encrypted.  It's just stored in the open, which kind of makes sense since the reader app needs to know the settings without prompting for the master password.  Whether the reader app respects the settings is up to the developer.

 

Still digging into encyrpted attachments...

 

DaveH

 

Dave,

The Open and Master password are technically considered equal and either one of them will allow you to decrypt the encrypted PDF data.  Without either password then the PDF cannot be read nor viewed.  It is up to the PDF viewer to respect the differences between the Open and Master password.

I am not up to speed with the Digital Signature but they is all fully documented in the PDF specifications which can by found via Google.

Andrew.

 

From the API docs I gather that the file itself is encrpted using the Open password.  Ie, no PDF tool will be able to read the file unless they get the password.  Being that this is the same password prompted for to the user, people tend to use weak passwords because - well who wants to keep keying in long passwords just to open a file.  So this I think I understand.

 

Now the Master password is suppose to lock the "permissions" of the file (print, copy & paste, etc) but this is only as good as the developer since after they call the Decrypt routine with the right Open password, they have full access to everything. So what does the Master password actually do to the PDF file.  Is it stored somewhere in the file? It would have to be right? so a properly built viewer app could verify the password and respect the permission settings.

 

And then there is the Digital Signature.  Is this actually stored in the PDF doc as an encrypted attachment (allowed since v1.7 I think).

 

Thanks for any insight behind the scenes,

DaveH