2.2.6.3 Office Binary Document RC4 CryptoAPI Encryption

  • Article

In a file that is password protected by using Office binary document RC4 CryptoAPI encryption as specified in [MS-OFFCRYPTO] section 2.3.5, FibBase.fEncrypted MUST be 1 and FibBase.fObfuscated MUST be 0.

The EncryptionHeader as specified in [MS-OFFCRYPTO] section 2.3.5.1 MUST be written in unencrypted form in the first FibBase.lKey bytes of the Table stream. The remainder of the Table stream, the WordDocument stream beyond the initial 68 bytes, and the entire Data stream MUST be encrypted.

These three streams of data MUST be encrypted in 512-byte blocks. The block number MUST be set to zero at the beginning of the stream and MUST be incremented at each 512 byte boundary. The encryption algorithm MUST be carried out at the beginning of the Table stream and the WordDocument stream even though some of the bytes are written in unencrypted form.

The ObjectPool storage MUST NOT be present and if the file contains OLE objects, the storage objects for the OLE objects MUST be stored in the Data stream as specified in sprmCPicLocation.

If fDocProps is set in the EncryptionHeader.Flags, the Encryption stream MUST be present, the Summary Information stream MUST NOT be present, and a placeholder Document Summary Information stream MUST be present as specified in [MS-OFFCRYPTO] section 2.3.5.4.

If fDocProps is not set in the EncryptionHeader.Flags, the Document Summary Information stream and the Summary Information stream MUST NOT be encrypted.

All other streams and storages MUST NOT be encrypted<8>.