2.2.6.1 XOR Obfuscation

  • Article

In a file that is password protected by using XOR obfuscation, FibBase.fEncrypted and FibBase.fObfuscated MUST both be 1.

The password verifier computed from the password as specified in Binary Document Password Verifier Derivation Method 2 in [MS-OFFCRYPTO] section 2.3.7.4 MUST be stored in FibBase.lKey.

The WordDocument stream, the Table stream, and the Data stream MUST be obfuscated using XOR Data Transformation Method 2 as specified in [MS-OFFCRYPTO] section 2.3.7.6. All other streams and storages MUST NOT be obfuscated.

The byte transformation specified in [MS-OFFCRYPTO] section 2.3.7.6 MUST be carried out in the WordDocument stream relative to the beginning of the stream, but the initial 68 bytes MUST be written out with their untransformed values.