Home » Acrobat 9, General News, PDF Security

Acrobat 9, ElcomSoft And Password Encryption

By Rowan Hanna on 7 January, 2009 | , 6 Comments

ElcomSoft has long been a thorn in Adobe’s side. It all started way back in 2001 when Dmitry Sklyarov, an employee of Russian company ElcomSoft, was arrested in Las Vegas for distributing a product (Advanced eBook Processor) that Adobe alleged was designed to circumvent copyright protection measures in its e-book software. A full run down of the incident can be found here – the charges were later dropped.

Fast-forward a few years to this press release (PDF, 593 KB) from ElcomSoft, in which they claim that their Advanced PDF Password Recovery product can unlock password-protected PDF files created in Acrobat 9 using 256-bit AES encryption one hundred times faster than it could unlock PDF files created in Acrobat 8 using 128-bit AES encryption, and it’s clear that ElcomSoft weren’t intimidated by the 2001 incident.

Adobe has, for their part, acknowledged that in certain circumstances this is more or less true. If you use 256-bit AES encryption on a document and a short password that consists of common words which can be found in a dictionary (“turkey”, “potato”, etc) then it is potentially more susceptible to brute-force cracking tools than 128-bit AES encryption because of improved performance in the opening speed of 256-bit AES password protected documents.

The current specification for password-based 256-bit AES encryption in PDF provides greater performance than the previous 128-bit AES implementation.  While this allows for 256-bit AES password protected documents to open faster in Acrobat 9, it can also allow external brute-force cracking tools to attempt to guess document passwords more rapidly because fewer processor cycles are required to test each password guess.

As one blogger pointed out, if you intend on using a password that is less than 32 characters in length, then you should consider using 128-bit AES encryption as it does not include the same performance improvements that make 256-bit AES encryption quicker to crack. Having said that, if you’re willing to use a password that has over 32 characters then 256-bit AES encryption (which supports passwords of up to 127 Roman characters in length) is the much stronger option.

Of course, the strength of the encryption largely depends on the unusualness of the password. For example, if you happen to be using any of the passwords that belong to this list of the 500 worst passwords of all time, then you’re off to a bad start. Adobe suggests that you pick a line or two from your favorite song or poem and add numbers or symbols if they aren’t already there. Alternatively, you could use something like Password Safe that generates some really hard to remember (read: long and totally random) passwords.

In the event that you’re looking for some really heavy duty protection for your PDF documents, Adobe has some additional recommendations:

For higher-assurance applications, Adobe continues to recommend using PKI-based encryption or Adobe LiveCycle Rights Management encryption – instead of user-generated document open passwords.  Acrobat and Adobe Reader 9 now support 256-bit AES encryption for both of these environments.  256-bit AES encryption is widely known to be stronger than 128-bit AES.  Document protection can also be increased with hardware tokens – including three-factor authentication with a smartcard, PIN and biometric.

What’s the moral of this story? If you don’t want your password-protected PDFs unlocked by Advanced PDF Password Recovery, choose a long and random password.

No related posts.

Quick PDF Library AdAdvertisement
1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading ... Loading ...

6 Comments »

  • Rowan Hanna (author) said:

    For those of you who are interested in using Password Safe, Joel Spolsky has a very useful tip on how you can combine it with DropBox to ensure that you have access to your really long and random passwords on all of your machines (Windows, Mac, Linux, etc).

    Read it: Password management finally possible

    # 7 January 2009 at 4:59 pm
  • Karl De Abrew said:

    Ah, yes — the classic “123456″ — a cracker proof password if ever I’ve seen one. I guess I’d better go change mine then :-)

    # 8 January 2009 at 10:29 am
  • Rowan Hanna (author) said:

    Jeff Atwood has written a little about how these brute force dictionary attacks are carried out. It is definitely not rocket science, which makes choosing a good password even more important.

    # 9 January 2009 at 5:03 am
  • James King On Digital Signatures | 4xPDF Blog said:

    [...] series of articles is definitely worth checking out if you’re worried about password encryption in Acrobat 9. Related Posts:Forget your password?Visit Digital Documents…Acrobat 9, ElcomSoft And Password [...]

    # 9 January 2009 at 5:57 am
  • How-to: Add A Digital Signature To A PDF File | 4xPDF Blog said:

    [...] useful. Especially for those of you who are nervous about password encryption after the recent Acrobat 9 and ElcomSoft [...]

    # 11 January 2009 at 5:10 pm
  • Rowan Hanna (author) said:

    If you want to generate long and high-quality random passwords, then I recommend checking out Perfect Passwrods. A little info:

    “The use of these maximum-entropy passwords minimizes (essentially zeroes) the likelihood of successful “dictionary attacks” since these passwords won’t appear in any dictionary. So you should always try to use passwords like these.”

    # 25 January 2009 at 9:07 am

Leave your response!

Add your comment below, or trackback from your own site. You can also subscribe to these comments via RSS.

Be nice. Keep it clean. Stay on topic. No spam.

You can use these tags:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

This is a Gravatar-enabled weblog. To get your own globally-recognized-avatar, please register at Gravatar.