Adobe Acrobat SDK
Syntax (Chapter 3 in PDF Reference)
Adobe® Supplement to the ISO 32000
3.5.3 Public-Key Security Handlers 21
1. Extend the permissions (contents of the
P
integer) to 64 bits by setting the upper 32 bits to all 1’s. (This
allows for future extension without changing the format.)
2. Record the 8 bytes of permission in the bytes 0-7 of the block, low order byte first.
3. Set byte 8 to the ASCII value '
T
' or '
F
' according to the
EncryptMetadata
Boolean.
4. Set bytes 9-11 to the ASCII characters '
a
', '
d
', '
b
'.
5. Set bytes 12-15 to 4 bytes of random data, which will be ignored.
6. Encrypt the 16-byte block using AES-256 in ECB mode with an initialization vector of zero, using the file
encryption key as the key. The result (16 bytes) is stored as the
Perms
string, and checked for validity
when the file is opened.
Algorithm 3.11
Authenticating the User Password
1. Test the password against the user key by computing the SHA-256 hash of the UTF-8 password
concatenated with the 8 bytes of User Validation Salt. If the 32-byte result matches the first 32 bytes of
the
U
string, this is the user password.
Algorithm 3.12
Authenticating the Owner Password
1. Test the password against the user key by computing the SHA-256 hash of the UTF-8 password
concatenated with the 8 bytes of Owner Validation Salt and the 48 byte
U
string. If the 32 byte result
matches the first 32 bytes of the
O
string, this is the user password.
Algorithm 3.13
Validating the Permissions
1. Decrypt the 16 byte
Perms
string using AES-256 in ECB mode with an initialization vector of zero and
the file encryption key as the key. Verify that bytes 9-11 of the result are the characters ‘
a
’, ‘
d
’, ‘
b
’. Bytes
0-3 of the decrypted
Perms
entry, treated as a little-endian integer, are the user permissions. They
should match the value in the
P
key. Byte 8 should match the boolean value of the
EncryptMetadata
key.
3.5.3 Public-Key Security Handlers
Public-Key Encryption Algorithms
On page 131, modify the paragraph shown below by inserting the indicated phrase.
The encryption key that is used by Algorithm 3.1 is calculated by means of an a SHA-1 message digest
operation
for a key length of 128 bits or a SHA-256 digest operation for a key length of 256 bits
that digests
the following data, in order:
