When encrypting MSWord documents within the Word 2016 app (most recent file format .docx) what encryption algorithm is used? Have any vulnerabilities been found thus far? Has it been audited?

Edit: Word 2013 information is freely available yet I have not found as much information for the 2016 version. I am only interested in the 2016 version.

  • "new" file format. Sigh. That format is a full decade old by now. – Marcus Müller Jan 23 '17 at 21:19
  • There is a specific vote reason for questions asking about how to break or assess the security of a system that do not show sufficient understanding of that system – in your case, that would have required you to show understanding of the wikipedia article with the well-sounding name Microsoft Office Password Protection – Marcus Müller Jan 23 '17 at 21:22
  • Good point for my use of the word "new". What I meant was "most recent". As for the wiki article, it bears no information on the encryption for Word 2016 which is why I am asking. – Psi Jan 23 '17 at 21:32
  • hm, "since ... uses ... AES" – Marcus Müller Jan 23 '17 at 21:39

You could go right back to the source, MS-OFFCRYPTO, which details how the container (usually: the zip archive that a .docx is) is to be encrypted.

It'll tell you that you should use an embedded encrypted stream using one of the supported CryptoProviders. At this point, it's probably easiest to check which one your Word uses – you can still open the .docx as zip file and look inside, but aside from a bit of document structure, the main content will be in an encrypted stream but described by rather readable XML attributes that specify how it was encrypted.

I'd expect crypto used to be no weaker than what was used before – AES with a 128 bit key length.

  • I was hoping they would have bumped it up to 256bit AES. Is there any way of finding out without having to check XML attributes? – Psi Jan 23 '17 at 22:13
  • I'd encourage you to read the ECMA standards – they're just pretty large and admittedly, I just grew tired of reading them (without having any interest in this on my own). – Marcus Müller Jan 23 '17 at 22:15
  • @ThomasHollis - there is no reason to bump up to 256 AES. Your Word document (and likely humans in general) will no longer exist by the time 128 bit AES becomes crackable. – TTT Jan 24 '17 at 4:17
  • @TTT I beg to differ. I was thinking of collating a messages to pass down the family generations with a bunch of information and pictures about the ancestral history. So you see why I hoped for 256-bit AES. – Psi Jan 24 '17 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.