What are the vulnerabilities of using a 256 bit encrypted PDF file over email?

Question

I often send confidential documents to others using encrypted PDF files (i.e. files with a user password, and typically with an owner password as well) to prevent both accidental forwards and snooping. These are typically generated by LibreOffice's export PDF function. I understand that the PDF format for Acrobat 9.0 and higher uses an AES 256 cipher, and I assume that recent versions of LibreOffice generate the same, though I can't find details on this.

What are the possible vulnerabilities in such a method? Particularly when using a public email service such as Gmail (where one assumes that the plaintext contents of all emails are already with the government, and god knows who else), and sending the files as attachments.

Answer 1

Since it is protected by a user password, it is vulnerable to brute force/dictionary attacks unless you choose a really long and complex password. It does not matter whether your are using AES 128 or 256 if your password is the weakest link. Someone who intercepted your email may try to brute force the password to read your PDF file.

If you want your document to be more secure, Adobe supports the use of PKI based encryption and digital signatures to mitigate the issue of using weak passwords. However, this requires the use of certificates. While encrypting, the publisher’s computer randomly generates a symmetric key (up to AES256), and encrypts that key to each recipient’s asymmetric public key to include in the document with the symmetric key encrypted content. In return, the recipient computer uses their own private key to decrypt the symmetric key, and then decrypt the document.

The randomly generated key should have a much higher entropy than your password to mitigate brute force attempts.

Answer 2

1. There are tools for cracking file encryption passwords, including PDF. Because it's using AES-256, which is designed to be fast, it's possible for someone to do dictionary and hybrid-dictionary attacks on the file at paces of millions per second. By using a public service, you allow anyone with access to mailboxes, such as Google employees, to try their hand at an offline attack. If the PDF is cracked, you will never know.
2. You lose deniability that you sent the message. The subject, body and headers of the MIME encoded mail all reveal details of the mail that could leak information about the contents and intention of the message.

If you must send an encrypted PDF to a recipient, don't use a protocol where a centralized server can act as a middle man. Instead, use a peer-to-peer client, where the only possible way to intercept the file is sniffing packets on the routers and switches in the path. Further, make sure the peer-to-peer client software supports client-to-client encryption. Even though the PDF may be encrypted, you will want to encrypt the rest of the IP packet data, to prevent leaking formation about the contents of the packets.

However, the ultimate way to transfer files securely is using an air gap. In other words, the Internet is never involved. Then faceless government agencies cannot even attempt deep packet inspection and cracking at the encrypted packets, that could even be generated with software that the agency has a backdoor to. Instead, create the file, encrypt it, transfer it to a USB stick, and physically give that copy to the recipient in question.