Our encrypted pdf file is hacked

Question

We encrypt our PDF with the following iText. However, someone was able to edit our pdf (I'm not sure how).

pdfWriter.setEncryption(null, null, PdfWriter.ALLOW_SCREENREADERS | PdfWriter.ALLOW_COPY | PdfWriter.ALLOW_PRINTING, PdfWriter.ENCRYPTION_AES_128); 

Is there a better way to protect PDF to prevent this?

Answer 1

PDF Encryption and restriction of information relies purely on the goodwill of the authors of the viewing software to enforce this restriction.

Generally speaking, for every application that has enough information to display a PDF document, enough information to print a PDF file, there is nothing you can do.

Since it has many open source PDF readers, it’s easy to create a viewer that simply ignores these restrictions.

See this explanation of the PDF encryption mechanism for details.

Answer 2

If your PDF file is encrypted using 128-bit AES, then it is safe from someone who does not know the key, the most plausible explanation is that someone had access to the key.

You might consider signing a PDF using RSA, this is a good way to make sure it has not been compromised.

Answer 3

Encryption that prevents pdf browsing works if the password is long enough.

DRM functions that allow you to view but disable other functions, such as printing, editing, ... work only if the reader cooperates. The user can use a hacked or third-party reader to circumvent such restrictions.

Answer 4

Add user password. This is the only thing that really matters. As you undoubtedly gathered from other answers, the owner password is a little joking.

The USER password is strong crypto ... up to 256-bit AES IIRC, although the original PDF cryptography specification only allows 40-bit encryption due to US export restrictions. Everything that was stronger than 40-bit was considered "ammunition." Gufi laws.

The OWNER password is not, it is more polite than anything else. PDF libraries try to support it to one degree or another, but open source PDF libraries are a quick change to pdf crackers code.

A blank user password means "use a predefined string of bytes listed in the PDF specification that any user can download." PDF content is still encrypted, but everyone knows the password, so it’s not very good for you. PDF viewers / libraries replace this byte string if there is no password.

PS:

When calling setEncryption :

• a null open password means "empty password", as I described above.
• a null owner password means "create random for me".

A random owner password means that "no one can legally modify the PDF" .. but that does not mean "no one can change the PDF."