I often send confidential documents to others using encrypted PDF files (i.e. files with a user password, and typically with an owner password as well) to prevent both accidental forwards and snooping. These are typically generated by LibreOffice's export PDF function. I understand that the PDF format for Acrobat 9.0 and higher uses an AES 256 cipher, and I assume that recent versions of LibreOffice generate the same, though I can't find details on this.

What are the possible vulnerabilities in such a method? Particularly when using a public email service such as Gmail (where one assumes that the plaintext contents of all emails are already with the government, and god knows who else), and sending the files as attachments.

  • Some things that come to mind are deniability you can't deny you sent that file, depending on the encryption method (I don't know the details) you might leak the fact that you encrypt stuff rather than just sending random data. Another side channel is the file size that can be used to track who contacted whom whith your information (and then infer the content from the people involved). Also you might want to use a method that ensures forward secrecy and a way to securely exchange passwords Dec 23, 2013 at 14:41

2 Answers 2


Since it is protected by a user password, it is vulnerable to brute force/dictionary attacks unless you choose a really long and complex password. It does not matter whether your are using AES 128 or 256 if your password is the weakest link. Someone who intercepted your email may try to brute force the password to read your PDF file.

If you want your document to be more secure, Adobe supports the use of PKI based encryption and digital signatures to mitigate the issue of using weak passwords. However, this requires the use of certificates. While encrypting, the publisher’s computer randomly generates a symmetric key (up to AES256), and encrypts that key to each recipient’s asymmetric public key to include in the document with the symmetric key encrypted content. In return, the recipient computer uses their own private key to decrypt the symmetric key, and then decrypt the document.

The randomly generated key should have a much higher entropy than your password to mitigate brute force attempts.

  • PDF has a key derivation function, a password is not used directly for a key. The main features are 256-bit padding, inclusion of file-specific identifiers (effectively salt, though not necessarily crypto-quality randomness), and 50-iteration MD5. See §3.5.2 of the PDF 1.7 Reference(warning: 1300+ page PDF). It's no PBKDF2, but it's something of a speedbump for dictionary attacks. Feb 27, 2014 at 0:17
  • Correction to the above: there is/was an issue with AES-256 (Acrobat 9/PDF 1.7, Extension Level 3): it used only a single SHA-256 operation. See pdflib.com/knowledge-base/pdf-security/encryption fixed in later versions ("extensions"). Feb 27, 2014 at 18:18
  1. There are tools for cracking file encryption passwords, including PDF. Because it's using AES-256, which is designed to be fast, it's possible for someone to do dictionary and hybrid-dictionary attacks on the file at paces of millions per second. By using a public service, you allow anyone with access to mailboxes, such as Google employees, to try their hand at an offline attack. If the PDF is cracked, you will never know.
  2. You lose deniability that you sent the message. The subject, body and headers of the MIME encoded mail all reveal details of the mail that could leak information about the contents and intention of the message.

If you must send an encrypted PDF to a recipient, don't use a protocol where a centralized server can act as a middle man. Instead, use a peer-to-peer client, where the only possible way to intercept the file is sniffing packets on the routers and switches in the path. Further, make sure the peer-to-peer client software supports client-to-client encryption. Even though the PDF may be encrypted, you will want to encrypt the rest of the IP packet data, to prevent leaking formation about the contents of the packets.

However, the ultimate way to transfer files securely is using an air gap. In other words, the Internet is never involved. Then faceless government agencies cannot even attempt deep packet inspection and cracking at the encrypted packets, that could even be generated with software that the agency has a backdoor to. Instead, create the file, encrypt it, transfer it to a USB stick, and physically give that copy to the recipient in question.

You must log in to answer this question.