How to Break PDF Encryption

## Overview

James Moon (PhD Student, University of Bonn, Data Security) and Fabian Ising (University of Bochum) presented PDFX—a systematic analysis of PDF encryption vulnerabilities revealing both structural and cryptographic flaws in how Adobe PDF implements document-level encryption. Adobe's PDF encryption using AES is considered secure in isolation, but the PDF standard misapplies encryption, leaving critical security gaps. Research demonstrates 250 billion PDF documents open annually (Adobe telemetry), with widespread adoption in banking, email encryption, government, and corporate security workflows (e.g., German banks send encrypted PDFs via email with passwords over SMS). PDFX introduces two novel attack classes: DirectExfiltration exploiting PDF's selective string/stream-only encryption allowing plaintext information leakage from unencrypted document structure, and CbcMalleability exploiting AES-CBC mode weaknesses to manipulate encrypted content without detection. Attacks apply to 27 popular PDF viewers including Adobe Reader. Active man-in-the-middle modification of encrypted PDFs enables decryption-time plaintext exfiltration to attacker servers.

## PDF Structure and Selective Encryption Mechanism

**PDF Document Architecture**: PDF documents consist of four sections: (1) header (version identifier like 1.7 or 2.0), (2) body (objects defining page content, images, fonts, formatting), (3) cross-reference table (offsets to objects enabling random access), (4) trailer (root object reference and metadata). PDF is processed from bottom to top, starting with trailer.

**Selective Encryption Model**: The PDF standard encrypts only strings and streams (text content and binary data potentially containing sensitive information) but leaves other object types (integers, booleans, names, arrays, dictionaries) unencrypted. This design preserves random access efficiency—PDF readers can access object indices without decrypting the entire document. Consequence: the entire PDF document structure, page layout, object hierarchy, and metadata remain visible to passive attackers despite AES encryption.

**Plaintext Information Leakage**: From an unencrypted encrypted PDF, passive attackers can observe: number of pages, page sizes and dimensions, number of objects, presence/absence of hyperlinks and annotations, document metadata (creation date, author fields if unencrypted), object count and hierarchy, section sizes and boundaries. While not the displayed content itself, this structural information reveals document extent, complexity, and composition—useful for targeted attacks or traffic analysis.

**CryptFilter Granularity**: PDF 2003 introduced CryptFilters allowing per-object encryption control. Different object types can use different encryption algorithms (AES, RC4) or remain unencrypted. Implementations use CryptFilters to selectively encrypt specific streams while leaving metadata unencrypted, creating a patchwork of protected/unprotected objects.

## Attack Classes: DirectExfiltration and CbcMalleability

**DirectExfiltration (Structural Attack)**: The PDF standard's selective encryption creates objects carrying information about content without encrypting the objects themselves. Attackers can modify unencrypted structural elements to trigger PDF processing that leaks plaintext. Example: modifying unencrypted content stream references or annotation objects to cause viewers to extract plaintext content during decryption, then leak it to attacker-controlled services embedded in the PDF. The viewer decrypts legitimately (using correct password) but the modified structure causes plaintext to be exfiltrated.

**CbcMalleability (Cryptographic Attack)**: AES-CBC mode encryption is malleable—attackers can flip ciphertext bits to predictably modify plaintext without knowing the key. By modifying encrypted PDF content streams and adjusting structural elements, attackers can cause carefully crafted plaintext corruption that encodes information (e.g., forcing specific plaintext bytes to specific values). PDF viewers attempt to render the corrupted plaintext, triggering error handling that may leak information about decryption results.

**Active MITM Attacker Model**: The attack requires an active man-in-the-middle who intercepts encrypted PDFs (in transit via email, cloud storage, file transfers), modifies the encrypted content and document structure, then relays the modified PDF to the intended recipient. When the recipient decrypts using the correct password, the modifications trigger information exfiltration. This is particularly practical in scenarios where encrypted PDFs are stored in cloud services or sent over email, where intermediate systems can be compromised.

**Practical Impact**: Attackers can extract plaintext from encrypted PDFs without cracking the encryption, defeating the security goals of end-to-end encryption. Real-world usage (banks sending encrypted PDFs via email with separate password channels) is vulnerable because the attacker can inject malicious modifications during the transit window.