Password Section

This sextion is found in documents that have been encrypted with a password. Its contents is not yet fully decoded. It is 29 bytes long.

Size Data Description

B Always A2 ?

W Always 01 00 ?

W Checksum ?

Encrypted Sections

If a file is encrypted by a password, only a few sections will actually be encrypted:

Filetype Section ID Section Name

Encryption Method

The plaintext is separated into blocks of 20 bytes. The last block is padded with bytes containing 30. Each block is encypted by adding a 20 byte long key. This key is somehow based on the plaintext password (probably through a similar, though different, hash function as that which is used to encrypt the password), and it is the same for each block.

The resulting encryption seems to be fairly weak. For a word file, for example, you can gather a lot of information from the other (unencrypted) sections; for a longer text, this is probably enough to break the encryption key, without ever needing the plaintext password! This could even be automated somewhat: if there is a Paragraph Element List, you know the length of each paragraph; you also know that (almost) all paragraphs end with a 06 byte.