encrypt

Documentation

Index

• func ComputeOValue(ownerPassword, userPassword []byte, keyLen, revision int) ([]byte, error)
• func ComputeUValue(encryptKey []byte, encrypt *types.PDFEncryption, fileID []byte, verbose bool) ([]byte, error)
• func ComputeUValueV5(password []byte, passwordKey []byte, encrypt *types.PDFEncryption, ...) ([]byte, error)
• func DecryptObject(objBytes []byte, objNum, genNum int, encrypt *types.PDFEncryption) ([]byte, error)
• func DecryptPDF(pdfBytes []byte, password []byte, verbose bool) (*types.PDFEncryption, error)
• func DecryptStringsInContent(content []byte, objNum, genNum int, enc *types.PDFEncryption) ([]byte, error)
• func DeriveEncryptionKey(password []byte, encrypt *types.PDFEncryption, fileID []byte, verbose bool) ([]byte, error)
• func DeriveEncryptionKeyV5(password []byte, encrypt *types.PDFEncryption, fileID []byte, verbose bool) ([]byte, error)
• func DeriveOwnerKey(ownerPassword []byte, encrypt *types.PDFEncryption, fileID []byte, ...) ([]byte, error)
• func DeriveOwnerKeyV5(ownerPassword []byte, encrypt *types.PDFEncryption, fileID []byte, ...) ([]byte, error)
• func DeriveUserKeyFromOwner(ownerKey []byte, _ *types.PDFEncryption, _ bool) ([]byte, error)
• func EncryptDictString(enc *types.PDFEncryption) []byte
• func EncryptObject(data []byte, objNum, genNum int, enc *types.PDFEncryption) ([]byte, error)
• func EncryptStringsInContent(content []byte, objNum, genNum int, enc *types.PDFEncryption) ([]byte, error)
• func ExtractFileID(pdfBytes []byte, verbose bool) []byte
• func ParseEncryptionDictionary(pdfBytes []byte, verbose bool) (*types.PDFEncryption, error)
• func PrepareEncryption(opts EncryptOptions) (*types.PDFEncryption, []byte, error)
• func UnwrapOwnerKeyV5(ownerPasswordKey []byte, encrypt *types.PDFEncryption, verbose bool) ([]byte, error)
• func UnwrapUserKeyV5(passwordKey []byte, encrypt *types.PDFEncryption, verbose bool) ([]byte, error)
• func VerifyUValueV5(password []byte, passwordKey []byte, encrypt *types.PDFEncryption, ...) (bool, error)
• type EncryptOptions

Functions

func ComputeOValue

func ComputeOValue(ownerPassword, userPassword []byte, keyLen, revision int) ([]byte, error)

ComputeOValue computes the /O entry for a new Standard encryption dictionary. This is Algorithm 3 from ISO 32000-1:2008 §7.6.3.4. keyLen is the number of bytes in the encryption key (16 for AES-128). revision must be 3 or 4 for the key-lengths this library supports.

func ComputeUValue

func ComputeUValue(encryptKey []byte, encrypt *types.PDFEncryption, fileID []byte, verbose bool) ([]byte, error)

ComputeUValue computes the U value for password verification For revision 4 (AES), the U value is 48 bytes: 32-byte hash + 16-byte validation salt Algorithm 5 from ISO 32000-1:2008

func ComputeUValueV5

func ComputeUValueV5(password []byte, passwordKey []byte, encrypt *types.PDFEncryption, fileID []byte, verbose bool) ([]byte, error)

ComputeUValueV5 computes the U value for V5/R5/R6 password verification Based on ISO 32000-2 section 7.6.4.4.9 - uses SHA-256 and AES-128 This function computes the U value from a password for verification purposes. The actual password (not the derived key) is required for proper verification.

func DecryptObject

func DecryptObject(objBytes []byte, objNum, genNum int, encrypt *types.PDFEncryption) ([]byte, error)

DecryptObject decrypts a single PDF object or stream Algorithm 1 from ISO 32000-1:2008 Implementation copied EXACTLY from PyPDF's _make_crypt_filter (lines 914-935) and CryptAES.decrypt (lines 73-88)

func DecryptPDF

func DecryptPDF(pdfBytes []byte, password []byte, verbose bool) (*types.PDFEncryption, error)

DecryptPDF verifies the password and derives the file encryption key. Returns the populated encryption info (EncryptKey set) so callers can decrypt individual objects on demand via DecryptObject. To produce a fully decrypted PDF document use manipulate.DecryptPDF instead.

func DecryptStringsInContent

func DecryptStringsInContent(content []byte, objNum, genNum int, enc *types.PDFEncryption) ([]byte, error)

DecryptStringsInContent walks raw PDF object content (a non-stream dictionary body) and decrypts every string value found — both hex <...> and literal (...) forms — re-encoding each as a literal string. It is the read-side complement of EncryptStringsInContent.

The document's /StrF crypt filter is honored deterministically: when it is /Identity (strings stored in the clear) the content is returned unchanged. There is no heuristic fallback — in a non-Identity document every string is ciphertext by definition.

func DeriveEncryptionKey

func DeriveEncryptionKey(password []byte, encrypt *types.PDFEncryption, fileID []byte, verbose bool) ([]byte, error)

DeriveEncryptionKey derives the encryption key from password Based on PDF encryption algorithm (ISO 32000) - Algorithm 2 (V1-V4) or 7.6.4.3.3 (V5+)

func DeriveEncryptionKeyV5

func DeriveEncryptionKeyV5(password []byte, encrypt *types.PDFEncryption, fileID []byte, verbose bool) ([]byte, error)

DeriveEncryptionKeyV5 derives the encryption key for V5/R5/R6 (AES-256) Based on ISO 32000-2 section 7.6.4.3.3 - SHA-256 based key derivation

func DeriveOwnerKey

func DeriveOwnerKey(ownerPassword []byte, encrypt *types.PDFEncryption, fileID []byte, verbose bool) ([]byte, error)

DeriveOwnerKey derives the encryption key from owner password Algorithm 3 from ISO 32000-1:2008 (V1-V4) or V5 algorithm (V5+)

func DeriveOwnerKeyV5

func DeriveOwnerKeyV5(ownerPassword []byte, encrypt *types.PDFEncryption, fileID []byte, verbose bool) ([]byte, error)

DeriveOwnerKeyV5 derives the owner password key for V5/R5/R6 Similar to DeriveEncryptionKeyV5 but uses owner password

func DeriveUserKeyFromOwner

func DeriveUserKeyFromOwner(ownerKey []byte, _ *types.PDFEncryption, _ bool) ([]byte, error)

DeriveUserKeyFromOwner is a pass-through: DeriveOwnerKey performs the full Algorithm 3 inverse and already returns the file encryption key directly.

func EncryptDictString

func EncryptDictString(enc *types.PDFEncryption) []byte

EncryptDictString returns the raw PDF dictionary bytes for the /Encrypt object produced by PrepareEncryption. Streams are always AES-128 encrypted via /StmF; the declared /StrF is derived from enc.StrFIdentity so the dictionary always matches what the write paths actually do with string values.

func EncryptObject

func EncryptObject(data []byte, objNum, genNum int, enc *types.PDFEncryption) ([]byte, error)

EncryptObject encrypts a stream or string payload belonging to object (objNum, genNum) using the document's encryption parameters. It is the exact inverse of DecryptObject:

• V1/V2: RC4 with the per-object MD5-derived key.
• V4/V5: AES-CBC with a random 16-byte IV prepended and PKCS#7 padding.

When enc is nil or carries no master key the data is returned unchanged, so callers can use it unconditionally on both encrypted and plain documents.

Note: the V5 (AES-256) branch mirrors DecryptObject's per-object MD5+sAlT derivation rather than the ISO 32000-2 scheme (which uses the file key directly). This round-trips within pdfer but is not interoperable with spec-compliant readers for genuine V5 documents; pdfer's own EncryptPDF only emits V4 (AES-128), which is spec-correct here.

func EncryptStringsInContent

func EncryptStringsInContent(content []byte, objNum, genNum int, enc *types.PDFEncryption) ([]byte, error)

EncryptStringsInContent walks a (non-stream) dictionary body and encrypts every string value it contains, emitting each as a hex string <...> of the encrypted bytes. Both literal (...) and hex <...> source strings are handled; dictionary delimiters << >> and comments are passed through untouched. It is the write-side complement of DecryptStringsInContent.

When enc is nil, or the document's string crypt filter is /Identity (strings stored in the clear), the content is returned unchanged.

func ExtractFileID

func ExtractFileID(pdfBytes []byte, verbose bool) []byte

ExtractFileID extracts the file ID from PDF trailer Returns the first element of the ID array (ID[0]) File ID can be in hex format: <7FB157EB...> or binary: (binary data)

func ParseEncryptionDictionary

func ParseEncryptionDictionary(pdfBytes []byte, verbose bool) (*types.PDFEncryption, error)

ParseEncryptionDictionary parses the /Encrypt dictionary from PDF

func PrepareEncryption

func PrepareEncryption(opts EncryptOptions) (*types.PDFEncryption, []byte, error)

PrepareEncryption computes all parameters needed to add AES-128 (V=4, R=4) encryption to a new PDF. It returns the populated encryption struct (with EncryptKey set) and a fresh 16-byte file ID.

Pass the result to PDFWriter.SetEncryption and write the /Encrypt dict with EncryptDictString.

func UnwrapOwnerKeyV5

func UnwrapOwnerKeyV5(ownerPasswordKey []byte, encrypt *types.PDFEncryption, verbose bool) ([]byte, error)

UnwrapOwnerKeyV5 unwraps the owner encryption key from /OE Similar to UnwrapUserKeyV5 but uses owner password derived key

func UnwrapUserKeyV5

func UnwrapUserKeyV5(passwordKey []byte, encrypt *types.PDFEncryption, verbose bool) ([]byte, error)

UnwrapUserKeyV5 unwraps the user encryption key from /UE using the password-derived key Based on ISO 32000-2 - uses AES-128 in ECB mode for key unwrapping

func VerifyUValueV5

func VerifyUValueV5(password []byte, passwordKey []byte, encrypt *types.PDFEncryption, fileID []byte, verbose bool) (bool, error)

VerifyUValueV5 verifies a password by comparing computed U value with stored U value Returns true if password is correct, false otherwise

Types

type EncryptOptions

type EncryptOptions struct {
	// UserPassword is the password required to open the document.
	// Leave nil or empty for no open-password (anyone can open).
	UserPassword []byte

	// OwnerPassword is the password that grants full control.
	// If empty, UserPassword is used for the owner role as well.
	OwnerPassword []byte

	// Permissions is the P flags bitmask (ISO 32000-1 §7.6.3.2).
	// Default (0) is interpreted as -4 (all permissions, only AES protection).
	Permissions int32
}

EncryptOptions configures PDF encryption for a new document.