1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
<?xml version="1.0" standalone="no"?>
<!DOCTYPE document PUBLIC "-//APACHE//DTD Documentation V1.1//EN"
"http://cvs.apache.org/viewcvs.cgi/*checkout*/xml-forrest/src/resources/schema/dtd/document-v11.dtd">
<document>
<header>
<title>PDF encryption.</title>
<authors>
<person name="J.Pietschmann" email="pietsch@apache.org"/>
</authors>
</header>
<body>
<section>
<title>Overview</title>
<p>
FOP supports encryption of PDF output, thanks to Patrick
C. Lankswert. This feature is commonly used to prevent unauthorized
viewing, printing, editing and copying text from the document
annotations. It is also possible to ask the user for a password in order
to view the contents. Note that there already exist third party
applications which can decrypt an encrypted PDF without effort and allow
the aforementioned operations, therefore the degree of protection is
limited.
</p>
<p>
For further information about features and restrictions regarding PDF
encryption, look at the documentation coming with Adobe Acrobat or the
technical documentation on the Adobe web site.
</p>
</section>
<section>
<title>Usage</title>
<p>
Encryption is enabled by supplying any of the encryption related
options.
</p>
<p>
An owner password with the <code>-o</code> option. This password is
actually used as encryption key. Usually it is also used by most tools
to disregard any restriction imposed on the PDF document.
</p>
<p>
If no owner password has been supplied but FOP was asked to apply some
restrictions, a random password is used.
</p>
<p>
A user password, supplied with the <code>-u</code> option, will
cause the PDF display software to ask the reader for this password in
order to view the contents of the document. If no user password was
supplied, viewing the content is not restricted.
</p>
<p>
Further restrictions can be imposed by using the <code>-noprint</code>,
<code>-nocopy</code>, <code>-noedit</code> and
<code>-noannotations</code> options, which disable printing, copying
text, editing in Adobe Acrobat and making annotations, respectively.
</p>
</section>
<section>
<title>Environment</title>
<p>
In order to use PDF encryption, FOP has to be compiled with cryptography
support. Currently, only <link
href="http://java.sun.com/j2se/1.4/docs/guide/security/jce/JCERefGuide.html">JCE</link>
is supported. JCE is part of JDK 1.4. For earlier JDKs, it can be
installed separately. The build process automatically senses JCE
presence and installs PDF support if possible, otherwise, a stub is
compiled in.
</p>
<p>
Cryptography support must also be present at run time. In particular, a
provider for the RC4 cipher is needed. Unfortunately, the sample JCE
provider in Sun's JDK 1.4 does <strong>not</strong> provide RC4. If you
get a message saying
</p>
<source>"Cannot find any provider supporting RC4"</source>
<p>
then you don't have the needed support.
</p>
<p>
There are several commercial and a few Open Source packages which
provide RC4. A pure Java implementation is produced by <link
href="http://www.bouncycastle.org/">The Legion of the Bouncy
Castle</link>. <link
href="http://www.mozilla.org/projects/security/pki/jss/">Mozilla
JSS</link> is an interface to a native implementation.
</p>
</section>
<section id="install_crypto">
<title>Installing a crypto provider</title>
<p>
The pure Java implementation from <link
href="http://www.bouncycastle.org/">Bouncy Castle</link> is easy to
install.
</p>
<ol>
<li>
Download the binary distribution for your JDK version. If you have JDK
1.3 or earlier you must also download a JCE from the same page.
</li>
<li>
Unpack the distribution. Add the jar file to your classpath. A
convenient way to use the jar on Linux is to simply drop it into the
FOP lib directory, it will be automatically picked up by
<code>fop.sh</code>. If you have JDK 1.3 or earlier don't forget to
install the JCE as well.
</li>
<li>
Open the <code>java.security</code> file and add<br/>
<code>security.provider.6=org.bouncycastle.jce.provider.BouncyCastleProvider</code>,<br/>
preferably at the end of the block defining the other crypto
providers. For JDK 1.4 this is detailed on <link href="http://java.sun.com/j2se/1.4/docs/guide/security/jce/JCERefGuide.html#InstallProvider">Sun's web site</link>.
</li>
</ol>
</section>
</body>
</document>
|
