Re: [pdf-devel] libgcrypt

[Hardy Falk]

Am Mittwoch, 24. Oktober 2007 00:45 schrieb address@hidden:
> Marcus Brinkmann pointed out that libgcrypt
> (http://www.gnu.org/software/libgcrypt) provide good
> implementations for both DES and AES algorithms.
>
> Could you please to take a look and determine if libgcrypt
> fit our needs, and then ACK? It is distributed under the LGPL
> 2.1 or later, so licensing is not an issue.
>
Some remarks on pdf and cryptography:
The pdf format has come a long and winding way from the first, 
simple RC4 content protection. The RC4 algorithm and its use 
have been public for a long time, and AES is well documented. 
Implementing a decrypting filter from scratch would be feasible.

But...  
If a PDF viewer works, all is well.   
Almost.
Who cares whether a decryption key might leak.
The gnu pdf project has ambitious goals. At least, Adobe has :-)
The chapters on cryptography and signatures are ever expanding - 
and they barely touch the surface. 
We will eventually need some serious cryptography.
Recommending libgcrypt, roughly 1 MByte of library bloat, seems 
almost a no-brainer to me.
We will need it in the long run, however silly it might look to 
use it for something as basic as a PDF decryption filter.
A quote from pdf_reference-1.7.pdf :
> A PDF document can be encrypted (PDF 1.1) to protect its
> contents from unauthorized access.
And from your "Goals and Motivations" section:
> ... public bounties, to access social insurance services, 
> to pay taxes and many other activities that require > >
> communication  with public agencies.
A long way indeed :-)
And keep up the good work.