rpdfium_parser/crypto/

fx_crypt.rs

// Derived from PDFium's core/fdrm/fx_crypt.h + core/fdrm/fx_crypt.cpp
// Original: Copyright 2014 The PDFium Authors
// Licensed under BSD-3-Clause / Apache-2.0
// See pdfium-upstream/LICENSE for the original license.

//! MD5, SHA-1 (stub), and RC4 primitives.
//!
//! Upstream: `fx_crypt.h` + `fx_crypt.cpp`

use md5::{Digest, Md5};

/// Errors arising from cryptographic operations.
#[derive(Debug, thiserror::Error)]
pub enum CryptoError {
    /// The supplied key has an invalid length for the algorithm.
    #[error("invalid key length")]
    InvalidKeyLength,
    /// The ciphertext length is not a multiple of the block size.
    #[error("invalid data length (must be multiple of block size)")]
    InvalidDataLength,
    /// PKCS#7 padding is invalid after decryption.
    #[error("invalid padding")]
    InvalidPadding,
    /// The data is too short to contain the required IV prefix.
    #[error("data too short for IV")]
    DataTooShort,
    /// The requested algorithm is not supported.
    #[error("not supported: {0}")]
    NotSupported(String),
}

/// Compute the MD5 hash of `data`.
pub fn md5(data: &[u8]) -> [u8; 16] {
    let mut hasher = Md5::new();
    hasher.update(data);
    hasher.finalize().into()
}

/// Compute the SHA-1 hash of `data`.
///
/// # Not Supported
///
/// SHA-1 is not used in PDF encryption (R2–R6 use MD5 or SHA-256/384/512).
/// If digital signature validation requires SHA-1 in the future, add the
/// `sha1` crate and replace this stub.
pub fn sha1(_data: &[u8]) -> Result<[u8; 20], CryptoError> {
    Err(CryptoError::NotSupported(
        "sha1: not needed for PDF encryption; add sha1 crate if digital signatures require it"
            .into(),
    ))
}

/// RC4 encrypt/decrypt (symmetric — same operation for both).
///
/// Accepts key lengths from 1 to 256 bytes, as used in PDF encryption
/// (typically 5 bytes for 40-bit or 16 bytes for 128-bit).
pub fn rc4_crypt(key: &[u8], data: &[u8]) -> Vec<u8> {
    assert!(
        !key.is_empty() && key.len() <= 256,
        "RC4 key length 1..=256"
    );

    // KSA (Key Scheduling Algorithm)
    let mut s = [0u8; 256];
    for (i, b) in s.iter_mut().enumerate() {
        *b = i as u8;
    }
    let mut j: u8 = 0;
    for i in 0..256 {
        j = j.wrapping_add(s[i]).wrapping_add(key[i % key.len()]);
        s.swap(i, j as usize);
    }

    // PRGA (Pseudo-Random Generation Algorithm)
    let mut i: u8 = 0;
    let mut j: u8 = 0;
    data.iter()
        .map(|&byte| {
            i = i.wrapping_add(1);
            j = j.wrapping_add(s[i as usize]);
            s.swap(i as usize, j as usize);
            let k = s[(s[i as usize].wrapping_add(s[j as usize])) as usize];
            byte ^ k
        })
        .collect()
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn sha1_not_supported() {
        let result = sha1(b"abc");
        assert!(result.is_err());
        assert!(
            result
                .unwrap_err()
                .to_string()
                .contains("not needed for PDF encryption")
        );
    }

    #[test]
    fn md5_empty() {
        let hash = md5(b"");
        assert_eq!(
            hash,
            [
                0xd4, 0x1d, 0x8c, 0xd9, 0x8f, 0x00, 0xb2, 0x04, 0xe9, 0x80, 0x09, 0x98, 0xec, 0xf8,
                0x42, 0x7e
            ]
        );
    }

    #[test]
    fn md5_abc() {
        let hash = md5(b"abc");
        assert_eq!(
            hash,
            [
                0x90, 0x01, 0x50, 0x98, 0x3c, 0xd2, 0x4f, 0xb0, 0xd6, 0x96, 0x3f, 0x7d, 0x28, 0xe1,
                0x7f, 0x72
            ]
        );
    }

    // ---- MD5 long data (upstream: MD5GenerateLongData, 10MB+1) ----

    #[test]
    fn md5_long_data() {
        let length = 10 * 1024 * 1024 + 1;
        let data: Vec<u8> = (0..length).map(|i| (i & 0xFF) as u8).collect();
        let hash = md5(&data);
        assert_eq!(
            hash,
            [
                0x90, 0xbd, 0x6a, 0xd9, 0x0a, 0xce, 0xf5, 0xad, 0xaa, 0x92, 0x20, 0x3e, 0x21, 0xc7,
                0xa1, 0x3e
            ]
        );
    }

    #[test]
    fn rc4_round_trip() {
        let key = b"secret";
        let plaintext = b"Hello, PDF encryption!";
        let ciphertext = rc4_crypt(key, plaintext);
        assert_ne!(ciphertext, plaintext);
        let decrypted = rc4_crypt(key, &ciphertext);
        assert_eq!(decrypted, plaintext);
    }

    #[test]
    fn rc4_known_vector() {
        let key = b"Key";
        let plaintext = b"Plaintext";
        let ciphertext = rc4_crypt(key, plaintext);
        assert_eq!(
            ciphertext,
            [0xBB, 0xF3, 0x16, 0xE8, 0xD9, 0x40, 0xAF, 0x0A, 0xD3]
        );
    }

    // ---- R5: MD5 RFC 1321 full test suite (upstream: fx_crypt_unittest.cpp) ----

    #[test]
    fn md5_rfc1321_a() {
        assert_eq!(
            md5(b"a"),
            [
                0x0c, 0xc1, 0x75, 0xb9, 0xc0, 0xf1, 0xb6, 0xa8, 0x31, 0xc3, 0x99, 0xe2, 0x69, 0x77,
                0x26, 0x61
            ]
        );
    }

    #[test]
    fn md5_rfc1321_message_digest() {
        assert_eq!(
            md5(b"message digest"),
            [
                0xf9, 0x6b, 0x69, 0x7d, 0x7c, 0xb7, 0x93, 0x8d, 0x52, 0x5a, 0x2f, 0x31, 0xaa, 0xf1,
                0x61, 0xd0
            ]
        );
    }

    #[test]
    fn md5_rfc1321_alphabet() {
        assert_eq!(
            md5(b"abcdefghijklmnopqrstuvwxyz"),
            [
                0xc3, 0xfc, 0xd3, 0xd7, 0x61, 0x92, 0xe4, 0x00, 0x7d, 0xfb, 0x49, 0x6c, 0xca, 0x67,
                0xe1, 0x3b
            ]
        );
    }

    #[test]
    fn md5_rfc1321_alphanumeric() {
        assert_eq!(
            md5(b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"),
            [
                0xd1, 0x74, 0xab, 0x98, 0xd2, 0x77, 0xd9, 0xf5, 0xa5, 0x61, 0x1c, 0x2c, 0x9f, 0x41,
                0x9d, 0x9f
            ]
        );
    }

    #[test]
    fn md5_rfc1321_numeric_repeated() {
        assert_eq!(
            md5(
                b"12345678901234567890123456789012345678901234567890123456789012345678901234567890"
            ),
            [
                0x57, 0xed, 0xf4, 0xa2, 0x2b, 0xe3, 0xc9, 0x55, 0xac, 0x49, 0xda, 0x2e, 0x21, 0x07,
                0xb6, 0x7a
            ]
        );
    }

    // ---- R3: RC4 upstream vector (upstream: fx_crypt_unittest.cpp, foobar key) ----

    #[test]
    fn rc4_foobar_key() {
        let key = b"foobar";
        // Upstream includes null terminator in data (C++ std::begin/std::end on char array)
        let data = b"The Quick Fox Jumped Over The Lazy Brown Dog.\0";
        let ciphertext = rc4_crypt(key, data);
        #[rustfmt::skip]
        let expected: &[u8] = &[
            59,  193, 117, 206, 167, 54,  218, 7,   229, 214, 188, 55,
            90,  205, 196, 25,  36,  114, 199, 218, 161, 107, 122, 119,
            106, 167, 44,  175, 240, 123, 192, 102, 174, 167, 105, 187,
            202, 70,  121, 81,  17,  30,  5,   138, 116, 166,
        ];
        assert_eq!(ciphertext, expected);
    }
}