Class PdfV4SecurityHandler

V4 security handler implementing AES-128-CBC encryption with crypt filters. Supports different encryption methods for strings, streams, and embedded files (PDF 1.5).

Example

const handler = new PdfV4SecurityHandler({
    password: 'user123',
    ownerPassword: 'admin456'
})
handler.setCryptFilter('StmFilter', new AesV2CryptFilter({ authEvent: 'DocOpen' }))

Hierarchy (View Summary)

PdfV2SecurityHandler
- PdfV4SecurityHandler
  - PdfV5SecurityHandler

Constructors

constructor

new PdfV4SecurityHandler(
options: PdfStandardSecurityHandlerOptions,
): PdfV4SecurityHandler
Creates a new V4 security handler with AES-128 encryption.
Parameters
- options: PdfStandardSecurityHandlerOptions
  Configuration options for the handler.
Returns PdfV4SecurityHandler
Overrides PdfV2SecurityHandler.constructor
- Defined in packages/pdf-lite/src/security/handlers/v4.ts:54

Properties

`Protected`cryptFilters

cryptFilters: Map<string, PdfCryptFilter> = ...

Map of named crypt filters.

`Protected`cryptFiltersByType

cryptFiltersByType: { file?: string; stream?: string; string?: string } = {}

Mapping of content types to crypt filter names.

dict

dict: PdfEncryptionDictionary

The encryption dictionary containing all encryption parameters.

`Protected` `Optional`documentId

documentId?: PdfId

Document identifier for key derivation.

encryptMetadata

encryptMetadata: boolean

Whether to encrypt document metadata.

`Protected` `Optional`masterKey

masterKey?: ByteArray

Derived master encryption key.

`Protected` `Optional`ownerKey

ownerKey?: ByteArray

Computed owner key (O value).

`Protected` `Optional`ownerPassword

ownerPassword?: ByteArray

Owner password for full access.

`Protected`password

password: ByteArray

User password for authentication.

permissions

permissions: number

Numeric permission flags.

`Protected` `Optional`userKey

userKey?: ByteArray

Computed user key (U value).

Methods

`Protected`buildPermissions

buildPermissions(perm: PdfPermissions): number
Builds the numeric permission flags from a PdfPermissions object.
Parameters
- perm: PdfPermissions
  The permissions to encode.
Returns number
The numeric permission flags.
Inherited from PdfV2SecurityHandler.buildPermissions
- Defined in packages/pdf-lite/src/security/handlers/base.ts:188

canEncryptMetadata

canEncryptMetadata(): boolean
Checks if metadata encryption is enabled.

Returns boolean
True if metadata should be encrypted.
Inherited from PdfV2SecurityHandler.canEncryptMetadata
- Defined in packages/pdf-lite/src/security/handlers/base.ts:445

`Protected`computeMasterKey

computeMasterKey(): Promise<ByteArray>
Computes the master encryption key from the password.

Returns Promise<ByteArray>
The computed master key.

Throws
Error if required parameters are missing or password is incorrect.
Inherited from PdfV2SecurityHandler.computeMasterKey
- Defined in packages/pdf-lite/src/security/handlers/v1.ts:104

computeObjectKey

computeObjectKey(
    objectNumber?: number,
    generationNumber?: number,
    algorithm?: PdfEncryptionAlgorithmType,
): Promise<ByteArray>
Computes the object-specific encryption key.
Parameters
- OptionalobjectNumber: number
  The PDF object number.
- OptionalgenerationNumber: number
  The PDF generation number.
- Optionalalgorithm: PdfEncryptionAlgorithmType
  Optional algorithm type for key derivation.
Returns Promise<ByteArray>
The computed object key.

Throws
Error if object or generation number is invalid.
Overrides PdfV2SecurityHandler.computeObjectKey
- Defined in packages/pdf-lite/src/security/handlers/v4.ts:140

`Protected`computeOwnerKey

computeOwnerKey(): Promise<ByteArray>
Computes the owner key (O value) using RC4-128 algorithm.

Returns Promise<ByteArray>
The computed owner key.
Inherited from PdfV2SecurityHandler.computeOwnerKey
- Defined in packages/pdf-lite/src/security/handlers/v2.ts:58

`Protected`computeUserKey

computeUserKey(): Promise<ByteArray>
Computes the user key (U value) using RC4-128 algorithm.

Returns Promise<ByteArray>
The computed user key.

Throws
Error if document ID, owner key, or permissions are not set.
Inherited from PdfV2SecurityHandler.computeUserKey
- Defined in packages/pdf-lite/src/security/handlers/v2.ts:71

decodePermissions

decodePermissions(): PdfPermissions
Decodes the numeric permission flags into a PdfPermissions object.

Returns PdfPermissions
An object with boolean flags for each permission.
Inherited from PdfV2SecurityHandler.decodePermissions
- Defined in packages/pdf-lite/src/security/handlers/base.ts:71

decrypt

decrypt(
    type: "string" | "stream" | "file",
    data: ByteArray,
    objectNumber?: number,
    generationNumber?: number,
): Promise<ByteArray>
Decrypts data using the appropriate crypt filter for the content type.
Parameters
- type: "string" | "stream" | "file"
  The type of content being decrypted.
- data: ByteArray
  The encrypted data.
- OptionalobjectNumber: number
  The PDF object number.
- OptionalgenerationNumber: number
  The PDF generation number.
Returns Promise<ByteArray>
The decrypted data.
Overrides PdfV2SecurityHandler.decrypt
- Defined in packages/pdf-lite/src/security/handlers/v4.ts:366

decryptObject

decryptObject(object: PdfIndirectObject): Promise<void>
Recursively decrypts all strings and streams within an indirect object.
Parameters
- object: PdfIndirectObject
  The indirect object to decrypt.
Returns Promise<void>
Inherited from PdfV2SecurityHandler.decryptObject
- Defined in packages/pdf-lite/src/security/handlers/base.ts:207

encrypt

encrypt(
    type: "string" | "stream" | "file",
    data: ByteArray,
    objectNumber?: number,
    generationNumber?: number,
): Promise<ByteArray>
Encrypts data using the appropriate crypt filter for the content type.
Parameters
- type: "string" | "stream" | "file"
  The type of content being encrypted.
- data: ByteArray
  The data to encrypt.
- OptionalobjectNumber: number
  The PDF object number.
- OptionalgenerationNumber: number
  The PDF generation number.
Returns Promise<ByteArray>
The encrypted data.
Overrides PdfV2SecurityHandler.encrypt
- Defined in packages/pdf-lite/src/security/handlers/v4.ts:343

encryptObject

encryptObject(object: PdfIndirectObject): Promise<void>
Recursively encrypts all strings and streams within an indirect object.
Parameters
- object: PdfIndirectObject
  The indirect object to encrypt.
Returns Promise<void>
Inherited from PdfV2SecurityHandler.encryptObject
- Defined in packages/pdf-lite/src/security/handlers/base.ts:252

`Protected`getCipher

getCipher(objectNumber?: number, generationNumber?: number): Promise<Cipher>
Gets an AES-128 cipher for the specified object.
Parameters
- OptionalobjectNumber: number
  The PDF object number.
- OptionalgenerationNumber: number
  The PDF generation number.
Returns Promise<Cipher>
An AES-128 cipher instance.
Overrides PdfV2SecurityHandler.getCipher
- Defined in packages/pdf-lite/src/security/handlers/v4.ts:176

getCryptFilter

getCryptFilter(name: string): PdfCryptFilter | undefined
Gets a crypt filter by name.
Parameters
- name: string
  The crypt filter name.
Returns PdfCryptFilter | undefined
The crypt filter, or undefined if not found.
- Defined in packages/pdf-lite/src/security/handlers/v4.ts:74

getCryptFilterByType

getCryptFilterByType(type: CryptFilterType): PdfCryptFilter | null
Gets the crypt filter assigned to a content type.
Parameters
- type: CryptFilterType
  The content type ('string', 'stream', or 'file').
Returns PdfCryptFilter | null
The assigned crypt filter, or null if none.
- Defined in packages/pdf-lite/src/security/handlers/v4.ts:84

getDocumentId

getDocumentId(): PdfId | undefined
Gets the document ID.

Returns PdfId | undefined
The document ID, or undefined if not set.
Inherited from PdfV2SecurityHandler.getDocumentId
- Defined in packages/pdf-lite/src/security/handlers/base.ts:414

getKeyBits

getKeyBits(): number
Gets the encryption key length in bits.

Returns number
128 for V2 encryption.
Inherited from PdfV2SecurityHandler.getKeyBits
- Defined in packages/pdf-lite/src/security/handlers/v2.ts:49

getName

getName(): string
Gets the security handler filter name.

Returns string
'Standard' for password-based encryption.
Inherited from PdfV2SecurityHandler.getName
- Defined in packages/pdf-lite/src/security/handlers/base.ts:387

getRevision

getRevision(): number
Gets the encryption revision number.

Returns number
4 for V4 encryption.
Overrides PdfV2SecurityHandler.getRevision
- Defined in packages/pdf-lite/src/security/handlers/v4.ts:118

getVersion

getVersion(): number
Gets the encryption version number.

Returns number
4 for crypt filter-based encryption.
Overrides PdfV2SecurityHandler.getVersion
- Defined in packages/pdf-lite/src/security/handlers/v4.ts:127

`Protected`initKeys

initKeys(): Promise<void>
Initializes the user and owner keys if not already set.

Returns Promise<void>
Inherited from PdfV2SecurityHandler.initKeys
- Defined in packages/pdf-lite/src/security/handlers/base.ts:510

isReady

isReady(): boolean
Checks if the handler is ready (has document ID).

Returns boolean
True if document ID is set.
Inherited from PdfV2SecurityHandler.isReady
- Defined in packages/pdf-lite/src/security/handlers/base.ts:396

readEncryptionDictionary

readEncryptionDictionary(encryptionDictionary: PdfEncryptionDictionary): void
Reads encryption parameters and crypt filter definitions from the dictionary.
Parameters
- encryptionDictionary: PdfEncryptionDictionary
  The encryption dictionary from the PDF.
Returns void
Overrides PdfV2SecurityHandler.readEncryptionDictionary
- Defined in packages/pdf-lite/src/security/handlers/v4.ts:190

recoverUserPassword

recoverUserPassword(ownerPassword?: string | ByteArray): Promise<string>
Recovers the user password from the owner password.
Parameters
- OptionalownerPassword: string | ByteArray
  The owner password.
Returns Promise<string>
The recovered user password as a string.
Inherited from PdfV2SecurityHandler.recoverUserPassword
- Defined in packages/pdf-lite/src/security/handlers/v2.ts:116

setCryptFilter

setCryptFilter(name: string, filter: PdfCryptFilter): void
Registers a named crypt filter.
Parameters
- name: string
  The filter name.
- filter: PdfCryptFilter
  The crypt filter instance.
Returns void
- Defined in packages/pdf-lite/src/security/handlers/v4.ts:108

setCryptFilterForType

setCryptFilterForType(type: CryptFilterType, name: string): void
Assigns a crypt filter to a content type.
Parameters
- type: CryptFilterType
  The content type.
- name: string
  The crypt filter name.
Returns void
- Defined in packages/pdf-lite/src/security/handlers/v4.ts:98

setDocumentId

setDocumentId(id: PdfId): void
Sets the document ID for key derivation.
Parameters
- id: PdfId
  The document ID array.
Returns void
Inherited from PdfV2SecurityHandler.setDocumentId
- Defined in packages/pdf-lite/src/security/handlers/base.ts:405

setMasterKey

setMasterKey(masterKey: ByteArray): void
Sets the master encryption key directly.
Parameters
- masterKey: ByteArray
  The master key to use.
Returns void
Inherited from PdfV2SecurityHandler.setMasterKey
- Defined in packages/pdf-lite/src/security/handlers/base.ts:611

setOwnerPassword

setOwnerPassword(ownerPassword: string | ByteArray): void
Sets the owner password.
Parameters
- ownerPassword: string | ByteArray
  The owner password string or bytes.
Returns void
Inherited from PdfV2SecurityHandler.setOwnerPassword
- Defined in packages/pdf-lite/src/security/handlers/base.ts:433

setPassword

setPassword(password: string | ByteArray): void
Sets the user password.
Parameters
- password: string | ByteArray
  The user password string or bytes.
Returns void
Inherited from PdfV2SecurityHandler.setPassword
- Defined in packages/pdf-lite/src/security/handlers/base.ts:423

write

write(): Promise<void>
Writes the encryption dictionary including crypt filter definitions.

Returns Promise<void>
Overrides PdfV2SecurityHandler.write
- Defined in packages/pdf-lite/src/security/handlers/v4.ts:302

Class PdfV4SecurityHandler

Example

Hierarchy (View Summary)

Index

Constructors

Properties

Methods

Constructors

constructor

Parameters

Returns PdfV4SecurityHandler

Properties

ProtectedcryptFilters

ProtectedcryptFiltersByType

dict

Protected OptionaldocumentId

encryptMetadata

Protected OptionalmasterKey

Protected OptionalownerKey

Protected OptionalownerPassword

Protectedpassword

permissions

Protected OptionaluserKey

Methods

ProtectedbuildPermissions

Parameters

Returns number

canEncryptMetadata

Returns boolean

ProtectedcomputeMasterKey

Returns Promise<ByteArray>

Throws

computeObjectKey

Parameters

Returns Promise<ByteArray>

Throws

ProtectedcomputeOwnerKey

Returns Promise<ByteArray>

ProtectedcomputeUserKey

Returns Promise<ByteArray>

Throws

decodePermissions

Returns PdfPermissions

decrypt

Parameters

Returns Promise<ByteArray>

decryptObject

Parameters

Returns Promise<void>

encrypt

Parameters

Returns Promise<ByteArray>

encryptObject

Parameters

Returns Promise<void>

ProtectedgetCipher

Parameters

Returns Promise<Cipher>

getCryptFilter

Parameters

Returns PdfCryptFilter | undefined

getCryptFilterByType

Parameters

Returns PdfCryptFilter | null

getDocumentId

Returns PdfId | undefined

getKeyBits

Returns number

getName

Returns string

getRevision

Returns number

getVersion

Returns number

ProtectedinitKeys

Returns Promise<void>

isReady

Returns boolean

readEncryptionDictionary

Parameters

`Protected`cryptFilters

`Protected`cryptFiltersByType

`Protected` `Optional`documentId

`Protected` `Optional`masterKey

`Protected` `Optional`ownerKey

`Protected` `Optional`ownerPassword

`Protected`password

`Protected` `Optional`userKey

`Protected`buildPermissions

`Protected`computeMasterKey

`Protected`computeOwnerKey

`Protected`computeUserKey

`Protected`getCipher

`Protected`initKeys