TY - CHAP A1 - Müller, Jens A1 - Ising, Fabian A1 - Mldadenov, Vladislav A1 - Mainka, Christian A1 - Schinzel, Sebastian A1 - Schwenk, Jörg T1 - Practical Decryption exFiltration: Breaking PDF Encryption T2 - The 26th ACM Conference on Computer and Communications, Security (CCS 2019), London, United Kingdom N2 - The Portable Document Format, better known as PDF, is one of themost widely used document formats worldwide, and in order to en-sure information confidentiality, this file format supports documentencryption. In this paper, we analyze PDF encryption and showtwo novel techniques for breaking the confidentiality of encrypteddocuments. First, we abuse the PDF feature ofpartially encrypteddocuments to wrap the encrypted part of the document withinattacker-controlled content and therefore, exfiltrate the plaintextonce the document is opened by a legitimate user. Second, we abusea flaw in the PDF encryption specification to arbitrarily manipulateencrypted content. The only requirement is that a single block ofknown plaintext is needed, and we show that this is fulfilled bydesign. Our attacks allow the recovery of the entire plaintext of en-crypted documents by using exfiltration channels which are basedon standard compliant PDF properties.We evaluated our attacks on 27 widely used PDF viewers andfound all of them to be vulnerable. We responsibly disclosed thevulnerabilities and supported the vendors in fixing the issue Y1 - 2019 UR - https://pdf-insecurity.org/download/paper-pdf_encryption-ccs2019.pdf U6 - https://doi.org/10.1145/3319535.3354214 ER -