2.4.117 FilePass

  • Article

The FilePass record specifies the encryption algorithm used to encrypt the workbook and the structure that is used to verify the password provided when attempting to open the workbook. If this record exists, the workbook MUST be encrypted. Refer to the Encryption (Password to Open) overview to understand the details of workbook files that have been encrypted.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

wEncryptionType

encryptionInfo (variable)

...

wEncryptionType (2 bytes):  A Boolean (section 2.5.14) that specifies the encryption type. MUST be a value from the following table:<86>

Value of wEncryptionType

Meaning

0x0000

XOR obfuscation

0x0001

RC4 encryption.  For more information about RC4 encryption, see [SCHNEIER] section 17.1

encryptionInfo (variable):  A variable type field.  The type and meaning of this field is dictated by the value of wEncryptionType.  If wEncryptionType is equal to 0x0000, this field is an XORObfuscation structure.  If wEncryptionType is equal to 0x0001, this field is an RC4 encryption header structure as specified in [MS-OFFCRYPTO], 2.3.5.1 or [MS-OFFCRYPTO], 2.3.6.1 depending on the value of the first two bytes. The first two bytes of the RC4 encryption header structure MUST be a value from the following table:

Value of the first two bytes of encryptionInfo

Type of encryptionInfo

0x0001

RC4 encryption header structure
[MS-OFFCRYPTO], 2.3.6.1

0x0002, 0x0003, or 0x0004

RC4 CryptoAPI encryption header structure
[MS-OFFCRYPTO], 2.3.5.1