Apache OpenOffice (AOO) Bugzilla – Issue 127161
PDF Encryption Breached
Last modified: 2016-10-17 20:00:46 UTC
I accidentally came across a problem with PDF encryption when attempting to modify one of my own secured OO PDF invoices for my company. I use a 3rd party templated saved invoice document which I insert data into using OO for a particular job & save as a PDF, using the internal encryption options to prevent modification. I needed to edit the date of an invoice which I had written incorrectly, so I tried to perform this task with the free graphics software I have called 'Inkscape'. Inkscape allowed me to open ( I tried this with more than one PDF) the PDF & modify the contents ignoring the encryption & save as a PDF. When reopened the encryption was no longer there. So all the invoices I have sent out to customers are potentially at risk of having their contents modified without my permission. To be honest it is not such a big deal to me. I am a one man show & the risk is negligible, but it might not be so for other people who create such documents containing sensitive data which they feel is totally safe. Justin.
The password protection against editing does not employ encryption. Only the password protection against opening employs encryption (so the document is not readable without the password). The protection against editing alone is a weak protection and apparently Inkscape overcame it without difficulty. There is a similar situation when OpenOffice saves documents as other than PDF. If a document is readable, it is possible to overcome any password protections on editing by manipulation of the document file. That protection is mainly against accidental modifications, not malicious alterations.
PS: Since the use of passwords to prevent editing (but not reading) involves weak protections that can be overcome by a malicious party, what can be done to deal with the prospect of alteration. An available approach is to digitally-sign any such document so that if there are alterations, the signature will either be removed or fail to verify. The signature also demonstrates the authenticity of the document that is provided to recipients. I don't know how that works for PDFs, but digital signatures will work for OpenOffice Calc and Writer documents. Any mechanism for signing PDFs is probably something that Adobe provides. I don't believe there is any provision in OpenOffice for successfully signing non-ODF documents. It is necessary to obtain a public-key certificate to do this. There are free ones available for users on Microsoft Windows. There are other arrangements for other platforms.