search

tdf / odftoolkit

Java ODF toolkit project
https://odftoolkit.org/
Apache License 2.0
115 stars 47 forks source link

encryption code is obsolete and supports only Blowfish/SHA1 #162

Open mistmist opened 2 years ago

mistmist commented 2 years ago

https://github.com/tdf/odftoolkit/blob/master/odfdom/src/main/java/org/odftoolkit/odfdom/pkg/OdfPackage.java#L1901

there is some encryption code in OdfPackage but it is using obsolete algorithms.

since OOo 3.4 "AES algorithm in CBC mode with W3C padding" and "SHA256" are used by default, so we should support these for interoperability.

these are the corresponding URLs:

AES256_URL = "http://www.w3.org/2001/04/xmlenc#aes256-cbc" SHA256_URL_ODF12 = "http://www.w3.org/2000/09/xmldsig#sha256" SHA256_URL = "http://www.w3.org/2001/04/xmlenc#sha256"

there are 2 different URLs for SHA256 because of a mistake - both should be supported for reading.

for the encryption algorithms see also:

https://api.libreoffice.org/docs/idl/ref/CipherID_8idl.html

hopefully this should all be possible with JDK: https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html

lawern commented 4 days ago

As I have already extended the decryption in issue #138, I would also take a look at the encryption in the next days. In the first step, I would encrypt with the same algorithms that were used for decryption. If this should be configurable, please send me your suggestions!