PdfEncryptor
in package
Encrypts PDF objects for the Standard and Adobe.PubSec security handlers.
Standard handler (password-based):
- V=1 R=2: RC4 40-bit (PDF 1.1+)
- V=2 R=3: RC4 128-bit (PDF 1.4+)
- V=4 R=4: AES-128 (PDF 1.6+)
- V=5 R=6: AES-256 (PDF 2.0)
Public-key handler (certificate-based, Adobe.PubSec):
- V=4 CFM=AESV2: AES-128 with PKCS#7 recipient envelopes
- V=4 CFM=AESV3: AES-256 with PKCS#7 recipient envelopes
Table of Contents
Constants
- PERM_ACCESSIBILITY = 512
- Extract text for accessibility.
- PERM_ALL = self::PERM_PRINT | self::PERM_MODIFY | self::PERM_COPY | self::PERM_ANNOTATE | self::PERM_FILL_FORMS | self::PERM_ACCESSIBILITY | self::PERM_ASSEMBLE | self::PERM_PRINT_HIGH
- All permissions granted.
- PERM_ANNOTATE = 32
- Add or modify annotations.
- PERM_ASSEMBLE = 1024
- Assemble the document (insert, rotate, delete pages).
- PERM_COPY = 16
- Copy/extract text and graphics.
- PERM_FILL_FORMS = 256
- Fill in form fields.
- PERM_MODIFY = 8
- Modify document contents.
- PERM_PRINT = 4
- Print the document.
- PERM_PRINT_HIGH = 2048
- High-quality print.
Methods
- aes128() : self
- Create an encryptor with AES 128-bit encryption (V=4 R=4, PDF 1.6+).
- aes256() : self
- Create an encryptor with AES 256-bit encryption (V=5 R=6, PDF 2.0).
- encryptDictionary() : void
- Encrypt all PdfString values within a dictionary.
- encryptObject() : void
- Encrypt a PdfObject in-place before serialization.
- getEncryptDictionary() : EncryptDictionary
- Get the EncryptDictionary to register in the file.
- getFileId() : string
- Get the file ID used for encryption (needed for the trailer /ID).
- getMinimumPdfVersion() : PdfVersion
- Return the minimum PDF version for this encryption: RC4 -> 1.4, AES-128 -> 1.6, AES-256 -> 2.0. Used by PdfFileWriter to auto-bump the document version when encryption is registered.
- publicKeyAes128() : self
- Create an encryptor with public-key (certificate-based) AES-128 encryption.
- publicKeyAes256() : self
- Create an encryptor with public-key (certificate-based) AES-256 encryption.
- rc4128() : self
- Create an encryptor with RC4 128-bit encryption (V=2 R=3, PDF 1.4+).
- rc440() : self
- Create an encryptor with RC4 40-bit encryption (V=1 R=2, PDF 1.1+).
- setEncryptDictObjNum() : void
- Set the object number of the encrypt dictionary so it's excluded from encryption.
Constants
PERM_ACCESSIBILITY
Extract text for accessibility.
public
mixed
PERM_ACCESSIBILITY
= 512
PERM_ALL
All permissions granted.
public
mixed
PERM_ALL
= self::PERM_PRINT | self::PERM_MODIFY | self::PERM_COPY | self::PERM_ANNOTATE | self::PERM_FILL_FORMS | self::PERM_ACCESSIBILITY | self::PERM_ASSEMBLE | self::PERM_PRINT_HIGH
PERM_ANNOTATE
Add or modify annotations.
public
mixed
PERM_ANNOTATE
= 32
PERM_ASSEMBLE
Assemble the document (insert, rotate, delete pages).
public
mixed
PERM_ASSEMBLE
= 1024
PERM_COPY
Copy/extract text and graphics.
public
mixed
PERM_COPY
= 16
PERM_FILL_FORMS
Fill in form fields.
public
mixed
PERM_FILL_FORMS
= 256
PERM_MODIFY
Modify document contents.
public
mixed
PERM_MODIFY
= 8
PERM_PRINT
Print the document.
public
mixed
PERM_PRINT
= 4
PERM_PRINT_HIGH
High-quality print.
public
mixed
PERM_PRINT_HIGH
= 2048
Methods
aes128()
Create an encryptor with AES 128-bit encryption (V=4 R=4, PDF 1.6+).
public
static aes128(string $userPassword, string $ownerPassword, string $fileId[, int $permissions = self::PERM_ALL ]) : self
Parameters
- $userPassword : string
- $ownerPassword : string
- $fileId : string
- $permissions : int = self::PERM_ALL
-
Bitmask of PERM_* constants
Return values
selfaes256()
Create an encryptor with AES 256-bit encryption (V=5 R=6, PDF 2.0).
public
static aes256(string $userPassword, string $ownerPassword, string $fileId[, int $permissions = self::PERM_ALL ]) : self
Parameters
- $userPassword : string
- $ownerPassword : string
- $fileId : string
- $permissions : int = self::PERM_ALL
-
Bitmask of PERM_* constants
Return values
selfencryptDictionary()
Encrypt all PdfString values within a dictionary.
public
encryptDictionary(PdfDictionary $dict, int $objNum, int $genNum) : void
Parameters
- $dict : PdfDictionary
- $objNum : int
- $genNum : int
encryptObject()
Encrypt a PdfObject in-place before serialization.
public
encryptObject(PdfObject $object) : void
For PdfStream: encrypts stream data and strings in the dictionary. For other PdfObjects: encrypts string values in public properties. Must NOT be called on the /Encrypt dictionary itself.
Parameters
- $object : PdfObject
getEncryptDictionary()
Get the EncryptDictionary to register in the file.
public
getEncryptDictionary() : EncryptDictionary
Return values
EncryptDictionarygetFileId()
Get the file ID used for encryption (needed for the trailer /ID).
public
getFileId() : string
Return values
stringgetMinimumPdfVersion()
Return the minimum PDF version for this encryption: RC4 -> 1.4, AES-128 -> 1.6, AES-256 -> 2.0. Used by PdfFileWriter to auto-bump the document version when encryption is registered.
public
getMinimumPdfVersion() : PdfVersion
Return values
PdfVersionpublicKeyAes128()
Create an encryptor with public-key (certificate-based) AES-128 encryption.
public
static publicKeyAes128(array<string|int, array{cert: string, permissions?: int}> $recipients, string $fileId) : self
Uses the Adobe.PubSec handler with /SubFilter /adbe.pkcs7.s5 (V=4). Each recipient's certificate receives a PKCS#7 envelope containing the encryption seed. Different recipients may have different permissions.
Parameters
- $recipients : array<string|int, array{cert: string, permissions?: int}>
-
Each entry: 'cert' = PEM certificate, 'permissions' = PERM_* bitmask (default PERM_ALL)
- $fileId : string
-
File identifier for the /ID trailer entry
Return values
selfpublicKeyAes256()
Create an encryptor with public-key (certificate-based) AES-256 encryption.
public
static publicKeyAes256(array<string|int, array{cert: string, permissions?: int}> $recipients, string $fileId) : self
Uses the Adobe.PubSec handler with /SubFilter /adbe.pkcs7.s5 (V=4, CFM=AESV3). File encryption key is 32 bytes, derived via SHA-256.
Parameters
- $recipients : array<string|int, array{cert: string, permissions?: int}>
-
Each entry: 'cert' = PEM certificate, 'permissions' = PERM_* bitmask (default PERM_ALL)
- $fileId : string
-
File identifier for the /ID trailer entry
Return values
selfrc4128()
Create an encryptor with RC4 128-bit encryption (V=2 R=3, PDF 1.4+).
public
static rc4128(string $userPassword, string $ownerPassword, string $fileId[, int $permissions = self::PERM_ALL ]) : self
Parameters
- $userPassword : string
- $ownerPassword : string
- $fileId : string
- $permissions : int = self::PERM_ALL
-
Bitmask of PERM_* constants
Return values
selfrc440()
Create an encryptor with RC4 40-bit encryption (V=1 R=2, PDF 1.1+).
public
static rc440(string $userPassword, string $ownerPassword, string $fileId[, int $permissions = self::PERM_ALL ]) : self
Parameters
- $userPassword : string
- $ownerPassword : string
- $fileId : string
- $permissions : int = self::PERM_ALL
-
Bitmask of PERM_* constants
Return values
selfsetEncryptDictObjNum()
Set the object number of the encrypt dictionary so it's excluded from encryption.
public
setEncryptDictObjNum(int $objNum) : void
Parameters
- $objNum : int