Encryption Specification in the ISO 32000 Reference

The ISO 32000 Reference allows the PDF-producing applications to encrypt PDF documents so that the access to the information in these documents is restricted only to authorized users. The encryption-related information is contained in the /Encrypt entry of the PDF document’s trailer. The /Encrypt dictionary specifies the name of the security handler that performs authentication of the access rights to the document and some additional information. The additional information may include the security handler’s revision and encryption algorithm’s version. See “Encryption,” Section 7.6 of the ISO 32000 document, 1.7, page 55. Find this document on the web store of the International Standards Organization (ISO).

The PDF-consuming applications decrypt encrypted documents before processing their content. Adobe Acrobat is actually an application that can both produce and consume PDF documents in this sense.

The ISO 32000 Reference provides two levels of encryption. The document-level methods for strings and streams may be different:

• The document-level encryption. At this level all strings and streams in the PDF document are encrypted using the same method.
• The stream-level encryption (Crypt filter). At this level individual streams can be encrypted using distinct methods. In this case the streams that do not contain distinct encryption designations and all strings are encrypted with the document-level encryption methods.

The ISO 32000 Reference describes two types of security handlers:

• Password Security, or the Standard Security Handler, page 58
• Certificate Security, or the Public-key Security Handler, page 64

At the same time the ISO 32000 provides the ability to add any other security handlers not specifically described in it, including Adobe LiveCycle Rights Management.

For the encryption of its content, PDF uses MD5, RC4 and AES encryption methods.

The password-based security handlers use MD5 and RC4 encryption methods to encrypt the passwords and permissions in the PDF file. RC4 or AES encryption methods are used to encrypt the PDF streams and strings regardless of the type of the security handler that calculated the encryption key.

The ISO 32000 Reference also connects the encryption of the content of a PDF document with the access permissions (encryption permissions). The application that decrypts the content of the encrypted PDF document is supposed to honor the access permissions and to perform only those operations on the PDF document that conform to these permissions. The Reference also contains additional access permission facilities besides those connected to encryption.

Encryption in Java

Java platform provides very elaborate facilities that facilitate the process of encryption and decryption in the Java applications. The Java Cryptography Architecture (JCA), is a framework for accessing and developing cryptographic functionality for the Java platform. It defines interfaces that all providers of the encryption technology in Java must follow.

The Java Cryptography Extension (JCE) extends the JCA API to include implementations of certain APIs for encryption, key exchange, and Message Authentication Code (MAC). JCE is included in the Java 2 SDK 1.4. This is the version on which PDF Java Toolkit is based.

JCA allows the Java Virtual Machine to include different cryptography providers that implement certain encryption algorithms. Java users can set up JVM to specify the order in which the cryptography providers are accessed. The JCA API contains getInstance() methods that search the JVM for a provider that implements the specified encryption algorithm in the order that the cryptography providers are set up in the JVM and delivers the object of the corresponding class of the first-found provider that implements the sought encryption. Since all cryptography providers must conform to the same interface, this method provides a lot of flexibility.

This Security Framework implementation presumes that the JVM on which the Java application that uses PDF Java Toolkit is executed contains JCE provider(s) that implement the encryption algorithms required in the ISO 32000 Reference. Specifically, the ISO 32000 Reference requires availability of the RC4 encryption, and AES encryption should also be available.  See Section 7.6.2, “General Encryption Algorithm,” page 57.