Go to most recent revision | Details | Last modification | View Log | RSS feed
Rev | Author | Line No. | Line |
---|---|---|---|
4680 | right-hear | 1 | #include "fitz.h" |
2 | #include "mupdf.h" |
||
3 | |||
4 | enum |
||
5 | { |
||
6 | PDF_CRYPT_NONE, |
||
7 | PDF_CRYPT_RC4, |
||
8 | PDF_CRYPT_AESV2, |
||
9 | PDF_CRYPT_AESV3, |
||
10 | PDF_CRYPT_UNKNOWN, |
||
11 | }; |
||
12 | |||
13 | typedef struct pdf_crypt_filter_s pdf_crypt_filter; |
||
14 | |||
15 | struct pdf_crypt_filter_s |
||
16 | { |
||
17 | int method; |
||
18 | int length; |
||
19 | }; |
||
20 | |||
21 | struct pdf_crypt_s |
||
22 | { |
||
23 | fz_obj *id; |
||
24 | |||
25 | int v; |
||
26 | int length; |
||
27 | fz_obj *cf; |
||
28 | pdf_crypt_filter stmf; |
||
29 | pdf_crypt_filter strf; |
||
30 | |||
31 | int r; |
||
32 | unsigned char o[48]; |
||
33 | unsigned char u[48]; |
||
34 | unsigned char oe[32]; |
||
35 | unsigned char ue[32]; |
||
36 | int p; |
||
37 | int encrypt_metadata; |
||
38 | |||
39 | unsigned char key[32]; /* decryption key generated from password */ |
||
40 | }; |
||
41 | |||
42 | static fz_error pdf_parse_crypt_filter(pdf_crypt_filter *cf, fz_obj *dict, char *name, int defaultlength); |
||
43 | |||
44 | /* |
||
45 | * Create crypt object for decrypting strings and streams |
||
46 | * given the Encryption and ID objects. |
||
47 | */ |
||
48 | |||
49 | fz_error |
||
50 | pdf_new_crypt(pdf_crypt **cryptp, fz_obj *dict, fz_obj *id) |
||
51 | { |
||
52 | pdf_crypt *crypt; |
||
53 | fz_error error; |
||
54 | fz_obj *obj; |
||
55 | |||
56 | crypt = fz_malloc(sizeof(pdf_crypt)); |
||
57 | memset(crypt, 0x00, sizeof(pdf_crypt)); |
||
58 | |||
59 | /* Common to all security handlers (PDF 1.7 table 3.18) */ |
||
60 | |||
61 | obj = fz_dict_gets(dict, "Filter"); |
||
62 | if (!fz_is_name(obj)) |
||
63 | { |
||
64 | pdf_free_crypt(crypt); |
||
65 | return fz_throw("unspecified encryption handler"); |
||
66 | } |
||
67 | if (strcmp(fz_to_name(obj), "Standard") != 0) |
||
68 | { |
||
69 | pdf_free_crypt(crypt); |
||
70 | return fz_throw("unknown encryption handler: '%s'", fz_to_name(obj)); |
||
71 | } |
||
72 | |||
73 | crypt->v = 0; |
||
74 | obj = fz_dict_gets(dict, "V"); |
||
75 | if (fz_is_int(obj)) |
||
76 | crypt->v = fz_to_int(obj); |
||
77 | if (crypt->v != 1 && crypt->v != 2 && crypt->v != 4 && crypt->v != 5) |
||
78 | { |
||
79 | pdf_free_crypt(crypt); |
||
80 | return fz_throw("unknown encryption version"); |
||
81 | } |
||
82 | |||
83 | crypt->length = 40; |
||
84 | if (crypt->v == 2 || crypt->v == 4) |
||
85 | { |
||
86 | obj = fz_dict_gets(dict, "Length"); |
||
87 | if (fz_is_int(obj)) |
||
88 | crypt->length = fz_to_int(obj); |
||
89 | |||
90 | /* work-around for pdf generators that assume length is in bytes */ |
||
91 | if (crypt->length < 40) |
||
92 | crypt->length = crypt->length * 8; |
||
93 | |||
94 | if (crypt->length % 8 != 0) |
||
95 | { |
||
96 | pdf_free_crypt(crypt); |
||
97 | return fz_throw("invalid encryption key length"); |
||
98 | } |
||
99 | if (crypt->length > 256) |
||
100 | { |
||
101 | pdf_free_crypt(crypt); |
||
102 | return fz_throw("invalid encryption key length"); |
||
103 | } |
||
104 | } |
||
105 | |||
106 | if (crypt->v == 5) |
||
107 | crypt->length = 256; |
||
108 | |||
109 | if (crypt->v == 1 || crypt->v == 2) |
||
110 | { |
||
111 | crypt->stmf.method = PDF_CRYPT_RC4; |
||
112 | crypt->stmf.length = crypt->length; |
||
113 | |||
114 | crypt->strf.method = PDF_CRYPT_RC4; |
||
115 | crypt->strf.length = crypt->length; |
||
116 | } |
||
117 | |||
118 | if (crypt->v == 4 || crypt->v == 5) |
||
119 | { |
||
120 | crypt->stmf.method = PDF_CRYPT_NONE; |
||
121 | crypt->stmf.length = crypt->length; |
||
122 | |||
123 | crypt->strf.method = PDF_CRYPT_NONE; |
||
124 | crypt->strf.length = crypt->length; |
||
125 | |||
126 | obj = fz_dict_gets(dict, "CF"); |
||
127 | if (fz_is_dict(obj)) |
||
128 | { |
||
129 | crypt->cf = fz_keep_obj(obj); |
||
130 | } |
||
131 | else |
||
132 | { |
||
133 | crypt->cf = NULL; |
||
134 | } |
||
135 | |||
136 | obj = fz_dict_gets(dict, "StmF"); |
||
137 | if (fz_is_name(obj)) |
||
138 | { |
||
139 | error = pdf_parse_crypt_filter(&crypt->stmf, crypt->cf, fz_to_name(obj), crypt->length); |
||
140 | if (error) |
||
141 | { |
||
142 | pdf_free_crypt(crypt); |
||
143 | return fz_rethrow(error, "cannot parse stream crypt filter (%d %d R)", fz_to_num(obj), fz_to_gen(obj)); |
||
144 | } |
||
145 | } |
||
146 | |||
147 | obj = fz_dict_gets(dict, "StrF"); |
||
148 | if (fz_is_name(obj)) |
||
149 | { |
||
150 | error = pdf_parse_crypt_filter(&crypt->strf, crypt->cf, fz_to_name(obj), crypt->length); |
||
151 | if (error) |
||
152 | { |
||
153 | pdf_free_crypt(crypt); |
||
154 | return fz_rethrow(error, "cannot parse string crypt filter (%d %d R)", fz_to_num(obj), fz_to_gen(obj)); |
||
155 | } |
||
156 | } |
||
157 | |||
158 | /* in crypt revision 4, the crypt filter determines the key length */ |
||
159 | if (crypt->strf.method != PDF_CRYPT_NONE) |
||
160 | crypt->length = crypt->stmf.length; |
||
161 | } |
||
162 | |||
163 | /* Standard security handler (PDF 1.7 table 3.19) */ |
||
164 | |||
165 | obj = fz_dict_gets(dict, "R"); |
||
166 | if (fz_is_int(obj)) |
||
167 | crypt->r = fz_to_int(obj); |
||
168 | else |
||
169 | { |
||
170 | pdf_free_crypt(crypt); |
||
171 | return fz_throw("encryption dictionary missing revision value"); |
||
172 | } |
||
173 | |||
174 | obj = fz_dict_gets(dict, "O"); |
||
175 | if (fz_is_string(obj) && fz_to_str_len(obj) == 32) |
||
176 | memcpy(crypt->o, fz_to_str_buf(obj), 32); |
||
177 | /* /O and /U are supposed to be 48 bytes long for revision 5, they're often longer, though */ |
||
178 | else if (crypt->r == 5 && fz_is_string(obj) && fz_to_str_len(obj) >= 48) |
||
179 | memcpy(crypt->o, fz_to_str_buf(obj), 48); |
||
180 | else |
||
181 | { |
||
182 | pdf_free_crypt(crypt); |
||
183 | return fz_throw("encryption dictionary missing owner password"); |
||
184 | } |
||
185 | |||
186 | obj = fz_dict_gets(dict, "U"); |
||
187 | if (fz_is_string(obj) && fz_to_str_len(obj) == 32) |
||
188 | memcpy(crypt->u, fz_to_str_buf(obj), 32); |
||
189 | else if (fz_is_string(obj) && fz_to_str_len(obj) >= 48 && crypt->r == 5) |
||
190 | memcpy(crypt->u, fz_to_str_buf(obj), 48); |
||
191 | else if (fz_is_string(obj) && fz_to_str_len(obj) < 32) |
||
192 | { |
||
193 | fz_warn("encryption password key too short (%d)", fz_to_str_len(obj)); |
||
194 | memcpy(crypt->u, fz_to_str_buf(obj), fz_to_str_len(obj)); |
||
195 | } |
||
196 | else |
||
197 | { |
||
198 | pdf_free_crypt(crypt); |
||
199 | return fz_throw("encryption dictionary missing user password"); |
||
200 | } |
||
201 | |||
202 | obj = fz_dict_gets(dict, "P"); |
||
203 | if (fz_is_int(obj)) |
||
204 | crypt->p = fz_to_int(obj); |
||
205 | else |
||
206 | { |
||
207 | pdf_free_crypt(crypt); |
||
208 | return fz_throw("encryption dictionary missing permissions value"); |
||
209 | } |
||
210 | |||
211 | if (crypt->r == 5) |
||
212 | { |
||
213 | obj = fz_dict_gets(dict, "OE"); |
||
214 | if (!fz_is_string(obj) || fz_to_str_len(obj) != 32) |
||
215 | { |
||
216 | pdf_free_crypt(crypt); |
||
217 | return fz_throw("encryption dictionary missing owner encryption key"); |
||
218 | } |
||
219 | memcpy(crypt->oe, fz_to_str_buf(obj), 32); |
||
220 | |||
221 | obj = fz_dict_gets(dict, "UE"); |
||
222 | if (!fz_is_string(obj) || fz_to_str_len(obj) != 32) |
||
223 | { |
||
224 | pdf_free_crypt(crypt); |
||
225 | return fz_throw("encryption dictionary missing user encryption key"); |
||
226 | } |
||
227 | memcpy(crypt->ue, fz_to_str_buf(obj), 32); |
||
228 | } |
||
229 | |||
230 | crypt->encrypt_metadata = 1; |
||
231 | obj = fz_dict_gets(dict, "EncryptMetadata"); |
||
232 | if (fz_is_bool(obj)) |
||
233 | crypt->encrypt_metadata = fz_to_bool(obj); |
||
234 | |||
235 | /* Extract file identifier string */ |
||
236 | |||
237 | if (fz_is_array(id) && fz_array_len(id) == 2) |
||
238 | { |
||
239 | obj = fz_array_get(id, 0); |
||
240 | if (fz_is_string(obj)) |
||
241 | crypt->id = fz_keep_obj(obj); |
||
242 | } |
||
243 | else |
||
244 | fz_warn("missing file identifier, may not be able to do decryption"); |
||
245 | |||
246 | *cryptp = crypt; |
||
247 | return fz_okay; |
||
248 | } |
||
249 | |||
250 | void |
||
251 | pdf_free_crypt(pdf_crypt *crypt) |
||
252 | { |
||
253 | if (crypt->id) fz_drop_obj(crypt->id); |
||
254 | if (crypt->cf) fz_drop_obj(crypt->cf); |
||
255 | fz_free(crypt); |
||
256 | } |
||
257 | |||
258 | /* |
||
259 | * Parse a CF dictionary entry (PDF 1.7 table 3.22) |
||
260 | */ |
||
261 | |||
262 | static fz_error |
||
263 | pdf_parse_crypt_filter(pdf_crypt_filter *cf, fz_obj *cf_obj, char *name, int defaultlength) |
||
264 | { |
||
265 | fz_obj *obj; |
||
266 | fz_obj *dict; |
||
267 | int is_identity = (strcmp(name, "Identity") == 0); |
||
268 | int is_stdcf = (!is_identity && (strcmp(name, "StdCF") == 0)); |
||
269 | |||
270 | if (!is_identity && !is_stdcf) |
||
271 | { |
||
272 | return fz_throw("Crypt Filter not Identity or StdCF (%d %d R)", fz_to_num(cf_obj), fz_to_gen(cf_obj)); |
||
273 | } |
||
274 | cf->method = PDF_CRYPT_NONE; |
||
275 | cf->length = defaultlength; |
||
276 | |||
277 | if (cf_obj == NULL) |
||
278 | { |
||
279 | cf->method = (is_identity ? PDF_CRYPT_NONE : PDF_CRYPT_RC4); |
||
280 | return fz_okay; |
||
281 | } |
||
282 | |||
283 | dict = fz_dict_gets(cf_obj, name); |
||
284 | if (!fz_is_dict(dict)) |
||
285 | { |
||
286 | return fz_throw("cannot parse crypt filter (%d %d R)", fz_to_num(cf_obj), fz_to_gen(cf_obj)); |
||
287 | } |
||
288 | obj = fz_dict_gets(dict, "CFM"); |
||
289 | if (fz_is_name(obj)) |
||
290 | { |
||
291 | if (!strcmp(fz_to_name(obj), "None")) |
||
292 | cf->method = PDF_CRYPT_NONE; |
||
293 | else if (!strcmp(fz_to_name(obj), "V2")) |
||
294 | cf->method = PDF_CRYPT_RC4; |
||
295 | else if (!strcmp(fz_to_name(obj), "AESV2")) |
||
296 | cf->method = PDF_CRYPT_AESV2; |
||
297 | else if (!strcmp(fz_to_name(obj), "AESV3")) |
||
298 | cf->method = PDF_CRYPT_AESV3; |
||
299 | else |
||
300 | fz_throw("unknown encryption method: %s", fz_to_name(obj)); |
||
301 | } |
||
302 | |||
303 | obj = fz_dict_gets(dict, "Length"); |
||
304 | if (fz_is_int(obj)) |
||
305 | cf->length = fz_to_int(obj); |
||
306 | |||
307 | /* the length for crypt filters is supposed to be in bytes not bits */ |
||
308 | if (cf->length < 40) |
||
309 | cf->length = cf->length * 8; |
||
310 | |||
311 | if ((cf->length % 8) != 0) |
||
312 | return fz_throw("invalid key length: %d", cf->length); |
||
313 | |||
314 | return fz_okay; |
||
315 | } |
||
316 | |||
317 | /* |
||
318 | * Compute an encryption key (PDF 1.7 algorithm 3.2) |
||
319 | */ |
||
320 | |||
321 | static const unsigned char padding[32] = |
||
322 | { |
||
323 | 0x28, 0xbf, 0x4e, 0x5e, 0x4e, 0x75, 0x8a, 0x41, |
||
324 | 0x64, 0x00, 0x4e, 0x56, 0xff, 0xfa, 0x01, 0x08, |
||
325 | 0x2e, 0x2e, 0x00, 0xb6, 0xd0, 0x68, 0x3e, 0x80, |
||
326 | 0x2f, 0x0c, 0xa9, 0xfe, 0x64, 0x53, 0x69, 0x7a |
||
327 | }; |
||
328 | |||
329 | static void |
||
330 | pdf_compute_encryption_key(pdf_crypt *crypt, unsigned char *password, int pwlen, unsigned char *key) |
||
331 | { |
||
332 | unsigned char buf[32]; |
||
333 | unsigned int p; |
||
334 | int i, n; |
||
335 | fz_md5 md5; |
||
336 | |||
337 | n = crypt->length / 8; |
||
338 | |||
339 | /* Step 1 - copy and pad password string */ |
||
340 | if (pwlen > 32) |
||
341 | pwlen = 32; |
||
342 | memcpy(buf, password, pwlen); |
||
343 | memcpy(buf + pwlen, padding, 32 - pwlen); |
||
344 | |||
345 | /* Step 2 - init md5 and pass value of step 1 */ |
||
346 | fz_md5_init(&md5); |
||
347 | fz_md5_update(&md5, buf, 32); |
||
348 | |||
349 | /* Step 3 - pass O value */ |
||
350 | fz_md5_update(&md5, crypt->o, 32); |
||
351 | |||
352 | /* Step 4 - pass P value as unsigned int, low-order byte first */ |
||
353 | p = (unsigned int) crypt->p; |
||
354 | buf[0] = (p) & 0xFF; |
||
355 | buf[1] = (p >> 8) & 0xFF; |
||
356 | buf[2] = (p >> 16) & 0xFF; |
||
357 | buf[3] = (p >> 24) & 0xFF; |
||
358 | fz_md5_update(&md5, buf, 4); |
||
359 | |||
360 | /* Step 5 - pass first element of ID array */ |
||
361 | fz_md5_update(&md5, (unsigned char *)fz_to_str_buf(crypt->id), fz_to_str_len(crypt->id)); |
||
362 | |||
363 | /* Step 6 (revision 4 or greater) - if metadata is not encrypted pass 0xFFFFFFFF */ |
||
364 | if (crypt->r >= 4) |
||
365 | { |
||
366 | if (!crypt->encrypt_metadata) |
||
367 | { |
||
368 | buf[0] = 0xFF; |
||
369 | buf[1] = 0xFF; |
||
370 | buf[2] = 0xFF; |
||
371 | buf[3] = 0xFF; |
||
372 | fz_md5_update(&md5, buf, 4); |
||
373 | } |
||
374 | } |
||
375 | |||
376 | /* Step 7 - finish the hash */ |
||
377 | fz_md5_final(&md5, buf); |
||
378 | |||
379 | /* Step 8 (revision 3 or greater) - do some voodoo 50 times */ |
||
380 | if (crypt->r >= 3) |
||
381 | { |
||
382 | for (i = 0; i < 50; i++) |
||
383 | { |
||
384 | fz_md5_init(&md5); |
||
385 | fz_md5_update(&md5, buf, n); |
||
386 | fz_md5_final(&md5, buf); |
||
387 | } |
||
388 | } |
||
389 | |||
390 | /* Step 9 - the key is the first 'n' bytes of the result */ |
||
391 | memcpy(key, buf, n); |
||
392 | } |
||
393 | |||
394 | /* |
||
395 | * Compute an encryption key (PDF 1.7 ExtensionLevel 3 algorithm 3.2a) |
||
396 | */ |
||
397 | |||
398 | static void |
||
399 | pdf_compute_encryption_key_r5(pdf_crypt *crypt, unsigned char *password, int pwlen, int ownerkey, unsigned char *validationkey) |
||
400 | { |
||
401 | unsigned char buffer[128 + 8 + 48]; |
||
402 | fz_sha256 sha256; |
||
403 | fz_aes aes; |
||
404 | |||
405 | /* Step 2 - truncate UTF-8 password to 127 characters */ |
||
406 | |||
407 | if (pwlen > 127) |
||
408 | pwlen = 127; |
||
409 | |||
410 | /* Step 3/4 - test password against owner/user key and compute encryption key */ |
||
411 | |||
412 | memcpy(buffer, password, pwlen); |
||
413 | if (ownerkey) |
||
414 | { |
||
415 | memcpy(buffer + pwlen, crypt->o + 32, 8); |
||
416 | memcpy(buffer + pwlen + 8, crypt->u, 48); |
||
417 | } |
||
418 | else |
||
419 | memcpy(buffer + pwlen, crypt->u + 32, 8); |
||
420 | |||
421 | fz_sha256_init(&sha256); |
||
422 | fz_sha256_update(&sha256, buffer, pwlen + 8 + (ownerkey ? 48 : 0)); |
||
423 | fz_sha256_final(&sha256, validationkey); |
||
424 | |||
425 | /* Step 3.5/4.5 - compute file encryption key from OE/UE */ |
||
426 | |||
427 | memcpy(buffer + pwlen, crypt->u + 40, 8); |
||
428 | |||
429 | fz_sha256_init(&sha256); |
||
430 | fz_sha256_update(&sha256, buffer, pwlen + 8); |
||
431 | fz_sha256_final(&sha256, buffer); |
||
432 | |||
433 | // clear password buffer and use it as iv |
||
434 | memset(buffer + 32, 0, sizeof(buffer) - 32); |
||
435 | aes_setkey_dec(&aes, buffer, crypt->length); |
||
436 | aes_crypt_cbc(&aes, AES_DECRYPT, 32, buffer + 32, ownerkey ? crypt->oe : crypt->ue, crypt->key); |
||
437 | } |
||
438 | |||
439 | /* |
||
440 | * Computing the user password (PDF 1.7 algorithm 3.4 and 3.5) |
||
441 | * Also save the generated key for decrypting objects and streams in crypt->key. |
||
442 | */ |
||
443 | |||
444 | static void |
||
445 | pdf_compute_user_password(pdf_crypt *crypt, unsigned char *password, int pwlen, unsigned char *output) |
||
446 | { |
||
447 | if (crypt->r == 2) |
||
448 | { |
||
449 | fz_arc4 arc4; |
||
450 | |||
451 | pdf_compute_encryption_key(crypt, password, pwlen, crypt->key); |
||
452 | fz_arc4_init(&arc4, crypt->key, crypt->length / 8); |
||
453 | fz_arc4_encrypt(&arc4, output, padding, 32); |
||
454 | } |
||
455 | |||
456 | if (crypt->r == 3 || crypt->r == 4) |
||
457 | { |
||
458 | unsigned char xor[32]; |
||
459 | unsigned char digest[16]; |
||
460 | fz_md5 md5; |
||
461 | fz_arc4 arc4; |
||
462 | int i, x, n; |
||
463 | |||
464 | n = crypt->length / 8; |
||
465 | |||
466 | pdf_compute_encryption_key(crypt, password, pwlen, crypt->key); |
||
467 | |||
468 | fz_md5_init(&md5); |
||
469 | fz_md5_update(&md5, padding, 32); |
||
470 | fz_md5_update(&md5, (unsigned char*)fz_to_str_buf(crypt->id), fz_to_str_len(crypt->id)); |
||
471 | fz_md5_final(&md5, digest); |
||
472 | |||
473 | fz_arc4_init(&arc4, crypt->key, n); |
||
474 | fz_arc4_encrypt(&arc4, output, digest, 16); |
||
475 | |||
476 | for (x = 1; x <= 19; x++) |
||
477 | { |
||
478 | for (i = 0; i < n; i++) |
||
479 | xor[i] = crypt->key[i] ^ x; |
||
480 | fz_arc4_init(&arc4, xor, n); |
||
481 | fz_arc4_encrypt(&arc4, output, output, 16); |
||
482 | } |
||
483 | |||
484 | memcpy(output + 16, padding, 16); |
||
485 | } |
||
486 | |||
487 | if (crypt->r == 5) |
||
488 | { |
||
489 | pdf_compute_encryption_key_r5(crypt, password, pwlen, 0, output); |
||
490 | } |
||
491 | } |
||
492 | |||
493 | /* |
||
494 | * Authenticating the user password (PDF 1.7 algorithm 3.6 |
||
495 | * and ExtensionLevel 3 algorithm 3.11) |
||
496 | * This also has the side effect of saving a key generated |
||
497 | * from the password for decrypting objects and streams. |
||
498 | */ |
||
499 | |||
500 | static int |
||
501 | pdf_authenticate_user_password(pdf_crypt *crypt, unsigned char *password, int pwlen) |
||
502 | { |
||
503 | unsigned char output[32]; |
||
504 | pdf_compute_user_password(crypt, password, pwlen, output); |
||
505 | if (crypt->r == 2 || crypt->r == 5) |
||
506 | return memcmp(output, crypt->u, 32) == 0; |
||
507 | if (crypt->r == 3 || crypt->r == 4) |
||
508 | return memcmp(output, crypt->u, 16) == 0; |
||
509 | return 0; |
||
510 | } |
||
511 | |||
512 | /* |
||
513 | * Authenticating the owner password (PDF 1.7 algorithm 3.7 |
||
514 | * and ExtensionLevel 3 algorithm 3.12) |
||
515 | * Generates the user password from the owner password |
||
516 | * and calls pdf_authenticate_user_password. |
||
517 | */ |
||
518 | |||
519 | static int |
||
520 | pdf_authenticate_owner_password(pdf_crypt *crypt, unsigned char *ownerpass, int pwlen) |
||
521 | { |
||
522 | unsigned char pwbuf[32]; |
||
523 | unsigned char key[32]; |
||
524 | unsigned char xor[32]; |
||
525 | unsigned char userpass[32]; |
||
526 | int i, n, x; |
||
527 | fz_md5 md5; |
||
528 | fz_arc4 arc4; |
||
529 | |||
530 | if (crypt->r == 5) |
||
531 | { |
||
532 | /* PDF 1.7 ExtensionLevel 3 algorithm 3.12 */ |
||
533 | |||
534 | pdf_compute_encryption_key_r5(crypt, ownerpass, pwlen, 1, key); |
||
535 | |||
536 | return !memcmp(key, crypt->o, 32); |
||
537 | } |
||
538 | |||
539 | n = crypt->length / 8; |
||
540 | |||
541 | /* Step 1 -- steps 1 to 4 of PDF 1.7 algorithm 3.3 */ |
||
542 | |||
543 | /* copy and pad password string */ |
||
544 | if (pwlen > 32) |
||
545 | pwlen = 32; |
||
546 | memcpy(pwbuf, ownerpass, pwlen); |
||
547 | memcpy(pwbuf + pwlen, padding, 32 - pwlen); |
||
548 | |||
549 | /* take md5 hash of padded password */ |
||
550 | fz_md5_init(&md5); |
||
551 | fz_md5_update(&md5, pwbuf, 32); |
||
552 | fz_md5_final(&md5, key); |
||
553 | |||
554 | /* do some voodoo 50 times (Revision 3 or greater) */ |
||
555 | if (crypt->r >= 3) |
||
556 | { |
||
557 | for (i = 0; i < 50; i++) |
||
558 | { |
||
559 | fz_md5_init(&md5); |
||
560 | fz_md5_update(&md5, key, 16); |
||
561 | fz_md5_final(&md5, key); |
||
562 | } |
||
563 | } |
||
564 | |||
565 | /* Step 2 (Revision 2) */ |
||
566 | if (crypt->r == 2) |
||
567 | { |
||
568 | fz_arc4_init(&arc4, key, n); |
||
569 | fz_arc4_encrypt(&arc4, userpass, crypt->o, 32); |
||
570 | } |
||
571 | |||
572 | /* Step 2 (Revision 3 or greater) */ |
||
573 | if (crypt->r >= 3) |
||
574 | { |
||
575 | memcpy(userpass, crypt->o, 32); |
||
576 | for (x = 0; x < 20; x++) |
||
577 | { |
||
578 | for (i = 0; i < n; i++) |
||
579 | xor[i] = key[i] ^ (19 - x); |
||
580 | fz_arc4_init(&arc4, xor, n); |
||
581 | fz_arc4_encrypt(&arc4, userpass, userpass, 32); |
||
582 | } |
||
583 | } |
||
584 | |||
585 | return pdf_authenticate_user_password(crypt, userpass, 32); |
||
586 | } |
||
587 | |||
588 | int |
||
589 | pdf_authenticate_password(pdf_xref *xref, char *password) |
||
590 | { |
||
591 | if (xref->crypt) |
||
592 | { |
||
593 | if (pdf_authenticate_user_password(xref->crypt, (unsigned char *)password, strlen(password))) |
||
594 | return 1; |
||
595 | if (pdf_authenticate_owner_password(xref->crypt, (unsigned char *)password, strlen(password))) |
||
596 | return 1; |
||
597 | return 0; |
||
598 | } |
||
599 | return 1; |
||
600 | } |
||
601 | |||
602 | int |
||
603 | pdf_needs_password(pdf_xref *xref) |
||
604 | { |
||
605 | if (!xref->crypt) |
||
606 | return 0; |
||
607 | if (pdf_authenticate_password(xref, "")) |
||
608 | return 0; |
||
609 | return 1; |
||
610 | } |
||
611 | |||
612 | int |
||
613 | pdf_has_permission(pdf_xref *xref, int p) |
||
614 | { |
||
615 | if (!xref->crypt) |
||
616 | return 1; |
||
617 | return xref->crypt->p & p; |
||
618 | } |
||
619 | |||
620 | unsigned char * |
||
621 | pdf_get_crypt_key(pdf_xref *xref) |
||
622 | { |
||
623 | if (xref->crypt) |
||
624 | return xref->crypt->key; |
||
625 | return NULL; |
||
626 | } |
||
627 | |||
628 | int |
||
629 | pdf_get_crypt_revision(pdf_xref *xref) |
||
630 | { |
||
631 | if (xref->crypt) |
||
632 | return xref->crypt->v; |
||
633 | return 0; |
||
634 | } |
||
635 | |||
636 | char * |
||
637 | pdf_get_crypt_method(pdf_xref *xref) |
||
638 | { |
||
639 | if (xref->crypt) |
||
640 | { |
||
641 | switch (xref->crypt->strf.method) |
||
642 | { |
||
643 | case PDF_CRYPT_NONE: return "None"; |
||
644 | case PDF_CRYPT_RC4: return "RC4"; |
||
645 | case PDF_CRYPT_AESV2: return "AES"; |
||
646 | case PDF_CRYPT_AESV3: return "AES"; |
||
647 | case PDF_CRYPT_UNKNOWN: return "Unknown"; |
||
648 | } |
||
649 | } |
||
650 | return "None"; |
||
651 | } |
||
652 | |||
653 | int |
||
654 | pdf_get_crypt_length(pdf_xref *xref) |
||
655 | { |
||
656 | if (xref->crypt) |
||
657 | return xref->crypt->length; |
||
658 | return 0; |
||
659 | } |
||
660 | |||
661 | /* |
||
662 | * PDF 1.7 algorithm 3.1 and ExtensionLevel 3 algorithm 3.1a |
||
663 | * |
||
664 | * Using the global encryption key that was generated from the |
||
665 | * password, create a new key that is used to decrypt indivual |
||
666 | * objects and streams. This key is based on the object and |
||
667 | * generation numbers. |
||
668 | */ |
||
669 | |||
670 | static int |
||
671 | pdf_compute_object_key(pdf_crypt *crypt, pdf_crypt_filter *cf, int num, int gen, unsigned char *key) |
||
672 | { |
||
673 | fz_md5 md5; |
||
674 | unsigned char message[5]; |
||
675 | |||
676 | if (cf->method == PDF_CRYPT_AESV3) |
||
677 | { |
||
678 | memcpy(key, crypt->key, crypt->length / 8); |
||
679 | return crypt->length / 8; |
||
680 | } |
||
681 | |||
682 | fz_md5_init(&md5); |
||
683 | fz_md5_update(&md5, crypt->key, crypt->length / 8); |
||
684 | message[0] = (num) & 0xFF; |
||
685 | message[1] = (num >> 8) & 0xFF; |
||
686 | message[2] = (num >> 16) & 0xFF; |
||
687 | message[3] = (gen) & 0xFF; |
||
688 | message[4] = (gen >> 8) & 0xFF; |
||
689 | fz_md5_update(&md5, message, 5); |
||
690 | |||
691 | if (cf->method == PDF_CRYPT_AESV2) |
||
692 | fz_md5_update(&md5, (unsigned char *)"sAlT", 4); |
||
693 | |||
694 | fz_md5_final(&md5, key); |
||
695 | |||
696 | if (crypt->length / 8 + 5 > 16) |
||
697 | return 16; |
||
698 | return crypt->length / 8 + 5; |
||
699 | } |
||
700 | |||
701 | /* |
||
702 | * PDF 1.7 algorithm 3.1 and ExtensionLevel 3 algorithm 3.1a |
||
703 | * |
||
704 | * Decrypt all strings in obj modifying the data in-place. |
||
705 | * Recurse through arrays and dictionaries, but do not follow |
||
706 | * indirect references. |
||
707 | */ |
||
708 | |||
709 | static void |
||
710 | pdf_crypt_obj_imp(pdf_crypt *crypt, fz_obj *obj, unsigned char *key, int keylen) |
||
711 | { |
||
712 | unsigned char *s; |
||
713 | int i, n; |
||
714 | |||
715 | if (fz_is_indirect(obj)) |
||
716 | return; |
||
717 | |||
718 | if (fz_is_string(obj)) |
||
719 | { |
||
720 | s = (unsigned char *) fz_to_str_buf(obj); |
||
721 | n = fz_to_str_len(obj); |
||
722 | |||
723 | if (crypt->strf.method == PDF_CRYPT_RC4) |
||
724 | { |
||
725 | fz_arc4 arc4; |
||
726 | fz_arc4_init(&arc4, key, keylen); |
||
727 | fz_arc4_encrypt(&arc4, s, s, n); |
||
728 | } |
||
729 | |||
730 | if (crypt->strf.method == PDF_CRYPT_AESV2 || crypt->strf.method == PDF_CRYPT_AESV3) |
||
731 | { |
||
732 | if (n & 15 || n < 32) |
||
733 | fz_warn("invalid string length for aes encryption"); |
||
734 | else |
||
735 | { |
||
736 | unsigned char iv[16]; |
||
737 | fz_aes aes; |
||
738 | memcpy(iv, s, 16); |
||
739 | aes_setkey_dec(&aes, key, keylen * 8); |
||
740 | aes_crypt_cbc(&aes, AES_DECRYPT, n - 16, iv, s + 16, s); |
||
741 | /* delete space used for iv and padding bytes at end */ |
||
742 | if (s[n - 17] < 1 || s[n - 17] > 16) |
||
743 | fz_warn("aes padding out of range"); |
||
744 | else |
||
745 | fz_set_str_len(obj, n - 16 - s[n - 17]); |
||
746 | } |
||
747 | } |
||
748 | } |
||
749 | |||
750 | else if (fz_is_array(obj)) |
||
751 | { |
||
752 | n = fz_array_len(obj); |
||
753 | for (i = 0; i < n; i++) |
||
754 | { |
||
755 | pdf_crypt_obj_imp(crypt, fz_array_get(obj, i), key, keylen); |
||
756 | } |
||
757 | } |
||
758 | |||
759 | else if (fz_is_dict(obj)) |
||
760 | { |
||
761 | n = fz_dict_len(obj); |
||
762 | for (i = 0; i < n; i++) |
||
763 | { |
||
764 | pdf_crypt_obj_imp(crypt, fz_dict_get_val(obj, i), key, keylen); |
||
765 | } |
||
766 | } |
||
767 | } |
||
768 | |||
769 | void |
||
770 | pdf_crypt_obj(pdf_crypt *crypt, fz_obj *obj, int num, int gen) |
||
771 | { |
||
772 | unsigned char key[32]; |
||
773 | int len; |
||
774 | |||
775 | len = pdf_compute_object_key(crypt, &crypt->strf, num, gen, key); |
||
776 | |||
777 | pdf_crypt_obj_imp(crypt, obj, key, len); |
||
778 | } |
||
779 | |||
780 | /* |
||
781 | * PDF 1.7 algorithm 3.1 and ExtensionLevel 3 algorithm 3.1a |
||
782 | * |
||
783 | * Create filter suitable for de/encrypting a stream. |
||
784 | */ |
||
785 | static fz_stream * |
||
786 | pdf_open_crypt_imp(fz_stream *chain, pdf_crypt *crypt, pdf_crypt_filter *stmf, int num, int gen) |
||
787 | { |
||
788 | unsigned char key[32]; |
||
789 | int len; |
||
790 | |||
791 | len = pdf_compute_object_key(crypt, stmf, num, gen, key); |
||
792 | |||
793 | if (stmf->method == PDF_CRYPT_RC4) |
||
794 | return fz_open_arc4(chain, key, len); |
||
795 | |||
796 | if (stmf->method == PDF_CRYPT_AESV2 || stmf->method == PDF_CRYPT_AESV3) |
||
797 | return fz_open_aesd(chain, key, len); |
||
798 | |||
799 | return fz_open_copy(chain); |
||
800 | } |
||
801 | |||
802 | fz_stream * |
||
803 | pdf_open_crypt(fz_stream *chain, pdf_crypt *crypt, int num, int gen) |
||
804 | { |
||
805 | return pdf_open_crypt_imp(chain, crypt, &crypt->stmf, num, gen); |
||
806 | } |
||
807 | |||
808 | fz_stream * |
||
809 | pdf_open_crypt_with_filter(fz_stream *chain, pdf_crypt *crypt, char *name, int num, int gen) |
||
810 | { |
||
811 | fz_error error; |
||
812 | pdf_crypt_filter cf; |
||
813 | |||
814 | if (strcmp(name, "Identity")) |
||
815 | { |
||
816 | error = pdf_parse_crypt_filter(&cf, crypt->cf, name, crypt->length); |
||
817 | if (error) |
||
818 | fz_catch(error, "cannot parse crypt filter (%d %d R)", num, gen); |
||
819 | else |
||
820 | return pdf_open_crypt_imp(chain, crypt, &cf, num, gen); |
||
821 | } |
||
822 | return chain; |
||
823 | } |
||
824 | |||
825 | void pdf_debug_crypt(pdf_crypt *crypt) |
||
826 | { |
||
827 | int i; |
||
828 | |||
829 | printf("crypt {\n"); |
||
830 | |||
831 | printf("\tv=%d length=%d\n", crypt->v, crypt->length); |
||
832 | printf("\tstmf method=%d length=%d\n", crypt->stmf.method, crypt->stmf.length); |
||
833 | printf("\tstrf method=%d length=%d\n", crypt->strf.method, crypt->strf.length); |
||
834 | printf("\tr=%d\n", crypt->r); |
||
835 | |||
836 | printf("\to=<"); |
||
837 | for (i = 0; i < 32; i++) |
||
838 | printf("%02X", crypt->o[i]); |
||
839 | printf(">\n"); |
||
840 | |||
841 | printf("\tu=<"); |
||
842 | for (i = 0; i < 32; i++) |
||
843 | printf("%02X", crypt->u[i]); |
||
844 | printf(">\n"); |
||
845 | |||
846 | printf("}\n"); |
||
847 | }>"); |