2.3.7 CryptSession10Container

  • Article

A container record that specifies encryption properties for the file.

Only the Office Binary Document RC4 CryptoAPI encryption method as specified in [MS-OFFCRYPTO] section 2.3.5 is supported.

The following conditions MUST apply for the Current User Stream (section 2.1.1) of an encrypted file:

  • The stream MUST NOT be encrypted.

  • The headerToken field of the CurrentUserAtom record (section 2.3.2) SHOULD<11> be equal to 0xF3D1C4DF.

The following conditions MUST apply for the PowerPoint Document Stream (section 2.1.2) of an encrypted file:

  • The UserEditAtom record (section 2.3.3) and the PersistDirectoryAtom record (section 2.3.4) MUST NOT be encrypted.

  • The rh field of this CryptSession10Container record MUST NOT be encrypted.

  • The data field of this CryptSession10Container record MUST be encrypted as specified in [MS-OFFCRYPTO] section 2.3.5.1.

  • All other parts of the stream MUST be encrypted.

  • The stream MUST contain exactly one UserEditAtom record.

  • The encryptSessionPersistIdRef field of the UserEditAtom record MUST exist. It MUST refer to a valid persist object, which MUST contain this CryptSession10Container record.

The Pictures Stream (section 2.1.3) MUST be encrypted.

The following conditions MUST apply for the Summary Info Stream (section 2.1.4) and Document Summary Info Stream (section 2.1.5) of an encrypted file if the fDocProps bit is not set in the data.EncryptionHeader.Flags field:

  • The Summary Info Stream MUST NOT exist.

  • The Encrypted Summary Info Stream (section 2.1.6) MUST exist.

  • The Document Summary Info Stream SHOULD exist but MUST be empty.

If the fDocProps bit is set in the data.EncrytionHeader.Flags field, the Summary Info Stream and Document Summary Info Stream MUST NOT be encrypted and MUST contain the same content as the unencrypted file.

Encrypted parts of an encrypted document MUST be decrypted according to the following rules:

  • A password hash MUST be generated from a password and the data.EncryptionVerifier.Salt field as specified in [MS-OFFCRYPTO] section 2.3.5.5.

  • The password MUST be the same as the password which was used to encrypt the file.

  • For each block number the derived encryption key MUST be generated from the password hash and the block number as specified in [MS-OFFCRYPTO] section 2.3.5.2.

  • The corresponding derived encryption key MUST be used to decrypt the data.

A persist object in the PowerPoint Document Stream is decrypted as follows:

  • For a persist object, the block number for the derived encryption key is the persist object identifier.

  • The derived encryption key for a persist object MUST be generated from the password hash and the persist object identifier.

  • The range of bytes of the persist object that MUST be decrypted using the derived encryption key is specified by:

    • The file offset of the persist object as specified in the PowerPoint Document Stream section.

    • The length in bytes which is 8 + the recLen field of the RecordHeader structure (section 2.3.1) at the file offset.

  • After decrypting, the range of bytes conforms to the content as specified by this document.

A picture in the Pictures Stream is decrypted as follows:

For each field of an OfficeArtBStoreContainerFileBlock record as specified in [MS-ODRAW] section 2.2.22 the following decryption steps apply:

  • The derived encryption key MUST be generated from the password hash and a block number equal to zero.

  • The size of each field in bytes MUST be decrypted with the derived encryption key.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

rh

...

data (variable)

...

rh (8 bytes): A RecordHeader structure that specifies the header for this record. Sub-fields are further specified in the following table:

Field

Meaning

rh.recVer

MUST be 0xF.

rh.recInstance

MUST be 0x000.

rh.recType

MUST be RT_CryptSession10Container (section 2.13.24).

data (variable): An EncryptionHeader record as specified in [MS-OFFCRYPTO] section 2.3.5.1. The length, in bytes, of the field is specified by rh.recLen.