Protect PDF documents no matter where they reside:
Free Trial & Demo
The Adobe™ PDF document format has been in development since 1991, and from as early as 1994 included security features that were aimed at preventing users from being able to make changes to a published documents. This involved the use of encryption as the only practical way of protecting information. The basis of PDF encryption is to prevent users viewing the file if they are not authorized, and if they are authorized, to control what they can do with the file (i.e. whether printing is allowed, etc.).
Early PDF document security relied on weak 40 bit encryption and soon after it was released methods of breaking it were freely available on the Internet. In 2001 128 bit encryption became available to prevent simple hacking of the native mode controls, and degraded printing, was also added. In 2008 256 bit encryption was added to Adobe 9 but the implmentation was not as secure as Adobe 8’s 128 bit encryption (the password checking routine consists of just one call to the SHA256 hash function) enabling passwords to be cracked a lot quicker.
Password recovery software is able to break Adobe PDF encryption since common PDF security flaws still undermine Acrobat PDF security to this day.
The early controls relied upon manual entry of either one or two passwords which allowed the user to override the controls initially placed on the document. The commonest method of attacking an encrypted PDF document is to try and break the 40 bit key implementation (the default if security has been selected for compatibilty with version 6 PDF documents and below). Advertisers such as Advanced PDF Password Recovery provide a solution that guarantees to break that level of protection in a few minutes, and can break higher levels of encryption (128 and 256) using various methods of attack. PDF Restrictions can be removed instantly regardless of the encryption algorithm or strength used. Other organizations such as Passware Kit Standard or PDF-Password-Recovery also use advanced techniques to remove PDF passwords, although they warn that the 128 bit algorithm itself cannot be practically attacked using brute force.
Fortunately (or unfortunately for some) most attacks are speeded up significantly by the choice of ‘poor’ passwords (8 characters or less that are common words). Whilst the 128 bit or 256 bit PDF encryption algorithm may be good, the choice of a poor password, so that users can remember it, defeats all the good technical work. If a weak (short and uncomplex) password is used PDF password cracking software will quickly decrypt Adobe PDF files regardless of whether they have user or owner passwords set and regardless of whether they are protected by 128 bit encryption or higher.
But users don’t even need to crack the PDF encryption in order to share PDF files with others. They can just forward the encrypted PDF along with the password. This of course defeats the purpose of using PDF encryption if your main goal was to prevent unauthorized sharing.
 |
What is the best way to encrypt PDF files? |
Clearly the use of passwords for PDF encryption (or encryption of any other document) is not the way forwards! In fact, we predict that password protected PDF documents will become obsolete in the near future as industry looks towards more secure solutions such as PDF DRM for secure document sharing.
PDF encryption security is in the process of moving towards using more secure methods such as public key technology for document protection. A number of companies have moved into this space adding their own approaches to PDF encryption using certificates, but they over-complicate the approach and do not supply any key management, making their systems impossible to manage. Some older products even had security flaws, such as plug-in systems where the key required to decrypt the PDF file is handed over to Adobe for processing – see PDF security flaws. Famously, in 2001 a programmer from Elcomsoft was prosecuted in the USA for publishing a program for removing PDF copyright protection on FileOpen PDF DRM products by attacking this weakness in the system.
Regardless of whether passwords or public keys are used to encrypt PDF files, you need to use DRM controls to restrict document use – otherwise, once a user has decrypted the PDF document they can do what they like with it. Adobe PDF restrictions can be removed regardless of whether a password or a certificate has been used to encrypt a PDF.
 |
Locklizard: a secure alternative to PDF password encryption & plugins |
 |
Why Locklizard for PDF Encryption? |
Locklizard takes your PDF protection seriously.
See our customer testimonials or read our case studies to see why thousands of organizations use Locklizard PDF security to securely share and sell their documents.
We have introduced a very simple method for allowing a copyright owner to specify controls that will be enforced on all recipients of a document. It provides for a simple, but cryptographically secure method of customer registration that transfers the true encryption key into the registered product by secure key exchange, and holds the key in a secure form prior to use. Locklizard enables you to encrypt PDF files without passwords – there are no passwords to manage or attack so the system cannot be compromised.
Customers, once registered, can receive files and use them seamlessly. However, they cannot transfer their registration to another computer system, and do not have access to the underlying secrets by which their access is authorized, so they cannot give those to other users. Your PDF files are locked to authorized users devices so they cannot be shared with others.
This creates a win-win for both supplier and customers and ensures your IPR and your revenue stream remains protected at all times.
