Reading this question about extracting PDF password hashes to feed into john the ripper has me wondering why password hashes are in a PDF in the first place? Shouldn't it be using the supplied password to derive a symmetric key, and then decrypt the contents of the PDF?
UPDATE: this question explains that PDF encryption uses a symmetric key like I expect. My question still stands about what
pdf2john.pl is doing to extract a password hash from a PDF file?