title: PDF encryption anomaly; version 1.5 using AES
body: <p>I'm not sure if this is the correct forum to ask this question so please accept my apologies in advance if this is the wrong place.</p>
  
  <p>I recently created an encrypted PDF file using <a href="https://www.qoppa.com/pdfstudio/" rel="nofollow">PDF Studio 11</a>. The software provides three encryption options:</p>
  
  <ul>
  <li>RC4</li>
  <li>128 AES</li>
  <li>256 AES</li>
  </ul>
  
  <p>256-bit AES requires the <a href="http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html" rel="nofollow">Java Cryptography Extension</a> (JCE) Unlimited Strength Jurisdiction Policy Files 8 be installed.</p>
  
  <p>I created three dummy files:</p>
  
  <ol>
  <li>test1.pdf [encrypted with RC4]</li>
  <li>test2.pdf [encrypted with 128]</li>
  <li>test3.pdf [encrypted with 256] </li>
  </ol>
  
  <p>When I opened them in a PDF viewer I saw that every single file has the PDF version stated as 1.5.</p>
  
  <p>I double checked this at the command line using qpdf and sure enough it was specified: "PDF Version: 1.5"</p>
  
  <p>I looked at the <em>Adobe PDF Reference, Fourth Edition, version 1.5</em> and it seems that 1.5 supports <strong>only</strong> RC4 128-bit encryption.</p>
  
  <p>qpdf indicated the following:</p>
  
  <ol>
  <li>test1.pdf [no mention of encryption, although PDF viewer requires password to open file]</li>
  <li>test2.pdf [AESv2]</li>
  <li>test3.pdf [AESv3]</li>
  </ol>
  
  <p>The first two test files opened in Evince after inputting the correct password but the third (the one encrypted with 256-bit AES) only opened in the Google Chrome PDF viewer; AFAIK Evince can't open 256-bit AES encrypted files.</p>
  
  <p>The output from qpdf, the available encryption options in PDF Studio, the requirement for the JCE to be installed and the fact that the third file couldn't be opened in Evince all lead me to the conclusion that the file <strong>is</strong> encrypted with 256-bit AES (or 128-bit AES where applicable).</p>
  
  <p>My questions are:</p>
  
  <ul>
  <li>if the 1.5 <em>standard</em> doesn't support AES then how can the document be encrypted with AES (unless PDF Studio is misreporting the version number)?</li>
  <li>if the editor (PDF Studio) <strong>is</strong> applying proper 256-bit AES and not complying with the 1.5 standard then why not assign it a higher PDF version? (I can't see any benefits in using a lower version number particularly as older software wouldn't be able to open it anyway).</li>
  <li>can the PDF metadata be effectively encrypted using AES (presuming AES is being properly applied) when using 1.5?</li>
  </ul>
  
  <p><strong>My understanding is that AES is only implemented in PDF versions 1.6 and 1.7.</strong> (I am aware there are shortcomings in Adobe's password handling of 256-bit AES in certain versions but that's a separate matter).</p>