Skip to content

encryption code is obsolete and supports only Blowfish/SHA1 #162

@mistmist

Description

@mistmist

https://github.com/tdf/odftoolkit/blob/master/odfdom/src/main/java/org/odftoolkit/odfdom/pkg/OdfPackage.java#L1901

there is some encryption code in OdfPackage but it is using obsolete algorithms.

since OOo 3.4 "AES algorithm in CBC mode with W3C padding" and "SHA256" are used by default, so we should support these for interoperability.

these are the corresponding URLs:

AES256_URL = "http://www.w3.org/2001/04/xmlenc#aes256-cbc"
SHA256_URL_ODF12 = "http://www.w3.org/2000/09/xmldsig#sha256"
SHA256_URL = "http://www.w3.org/2001/04/xmlenc#sha256"

there are 2 different URLs for SHA256 because of a mistake - both should be supported for reading.

for the encryption algorithms see also:

https://api.libreoffice.org/docs/idl/ref/CipherID_8idl.html

hopefully this should all be possible with JDK: https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html

Metadata

Metadata

Assignees

No one assigned

    Labels

    help wantedExtra attention is needed

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions