Encryption, certificates and signatures

Aes128Backend

Aes256Backend

The CBC and ECB operations required by supplement Algorithms 3.1a, 3.2a and 3.10.

AuthenticatedFileKey

The authenticated key and access class, after checking the encrypted Perms block.

AuthenticatedHistoricalFileKey

The authenticated key and access class, independently of any file reader.

AuthenticatedPublicKey

First matching recipient envelope's key and permissions (7.6.4.2).

CertificateChain

Signing certificate first, followed by explicit intermediate certificates (12.8.3).

CmsEnvelopeBackend

The PDF object model supplies bytes and normalized certificate objects to an explicit CMS processor.

CmsTemporaryFiles

Native PHP CMS APIs require files. Staging is isolated per operation and removed in finally.

DerOctetString

The DER OCTET STRING wrapper required by adbe.x509.rsa_sha1 Contents (12.8.3.2).

DocumentMetadataExemption

The identity of Catalog/Metadata, the document-level EncryptMetadata exception.

EncryptMetadata

The explicit EncryptMetadata flag, supplement PDF pages 18 and 21.

EncryptionVersionPolicy

ISO 32000-2:2020, Table 21, physical PDF page 93: R=5 shall not be used.

FileEncryption

A file-scoped security operation, shared by the ISO and Adobe handlers.

FileEncryptionKey

A 256-bit file key; adobe_supplement_iso32000.pdf, PDF pages 16 and 20.

FileIdentifier

One explicit 128-bit file identifier, supplied as a PDF byte-string object.

HistoricalDataCipher

Crypt filter methods from ISO table 25, PDF page 76.

HistoricalEncryptionKey

A derived legacy 40–128-bit file key; no RC4/AES-128 writer is selected.

HistoricalKeyLength

Legacy encryption Length in bits: 40–128, in complete bytes.

HistoricalObjectKeyDerivation

ISO 7.6.2 Algorithm 1, steps a–d, PDF page 66.

HistoricalOwnerPasswordEntry

The existing 32-byte O entry used by historical Algorithm 3.2.

HistoricalPermissions

ISO table 22, PDF page 69, including revision-specific reserved permission bits.

HistoricalPublicKey256KeyDerivation

SHA-256 public-key key primitive, adobe_supplement_iso32000.pdf PDF page 21,

HistoricalRevision5Encryption

An explicitly selected historical AESV3/R=5 file operation (supplement page 16).

HistoricalRevision5SecurityHandler

Explicit historical R=5 protocol from adobe_supplement_iso32000.pdf, pages 19–21.

HistoricalSecurityRevision

Legacy Standard Security Handler revisions covered by supplement Algorithm 3.2.

HistoricalStandardEncryption

Explicit ISO R=2/3/4 file encryption, including per-object keys and crypt selection.

HistoricalStandardEncryptionDictionary

Standard R=2/3/4 security dictionary, ISO 7.6.3, PDF pages 64–76.

HistoricalStandardKeyDerivation

The historical MD5 key primitive only: supplement Algorithm 3.2, pages 18–19.

HistoricalStandardSecurityHandler

ISO 7.6.3 Algorithms 2–7, physical PDF pages 69–72; explicit legacy protocols.

InitializationVector

The AES block size is 16 bytes (supplement PDF page 16, Algorithm 3.1a).

LegacyPublicKeyEncryption

Public-key V=1/2 without crypt filters, PDF32000_2008.pdf, 7.6.4 PDF pp.72–75.

OpenSslAes128Backend

Optional native AES-128 backend, selected explicitly by the application.

OpenSslAes256Backend

Optional native backend. Constructing it explicitly requires ext-openssl.

OpenSslCmsEnvelopeBackend

DER EnvelopedData, AES-128-CBC payload and RSA key transport through the optional native backend.

OpenSslIdentity

Explicit native backend credentials. PEM bytes are inputs, never filenames or automatic file reads.

OpenSslRecipientDecrypter

Native private-key access is isolated from PDF construction and explicit per recipient operation.

OpenSslSignatureBackend

Explicit mathematical signature backend. Trust, revocation and timestamp policy remain caller-owned.

OpenSslSignatureCertificateFacts

Parsed credential facts and mathematically verified issuer links; no trust-anchor or validity assertion.

OpenSslSignatureOutputVerifier

Mathematical validation with the expected credential; deliberately does not assert PKI trust.

PasswordAccess

Password authentication records whether user or owner permissions apply.

PdfDocEncodedPassword

Explicit bytes already encoded as PDFDocEncoding by the caller, not UTF-8 text.

PreparedPassword

Caller-prepared SASLprep UTF-8 input. Prefer Saslprep::prepare() for raw input.

PublicKeyCipher

PublicKeyCipherOperation

Per-filter key/cipher binding, including object-specific RC4/AESV2 and object-independent AESV3.

PublicKeyCryptFilter

One public-key crypt filter and its own key/envelopes, PDF32000_2008.pdf, Tables25/27, pp.76–77.

PublicKeyEncryption

Public-key V=4/5 file operation with independent named crypt keys and actual stream selectors.

PublicKeyFilterConfiguration

Explicit string/default-stream/embedded-file selection; each named filter has an independent key.

PublicKeyKeyDerivation

Ordered seed/envelopes digest, ISO 7.6.4.3 PDF p.75 and Adobe AESV3 PDF p.21.

PublicKeyKeyLength

PDF key length in bits, including Adobe AESV3's 256-bit extension.

PublicKeyKeyMaterial

Immutable ordered CMS envelopes and seed-bound file/filter key.

PublicKeyPermissionByteOrder

ISO2008 7.6.4.3 p.74 prints least-significant first. Most-significant first

PublicKeyPermissions

Public-key permission bits are an unsigned 32-bit word, PDF32000_2008.pdf, Table24, PDF pages73–74.

PublicKeyRecipient

Opaque CMS bytes and optional declared payload permissions; this object does not validate ASN.1.

PublicKeyRecipientGroup

One CMS envelope groups certificates with equal access rights; no external certificate lookup.

PublicKeyRecipientScope

Table27: document defaults include permissions; individual Crypt streams have one seed-only envelope.

PublicKeySecurityHandler

Actual CMS recipient grouping and seed/key construction (ISO7.6.4.3 and Adobe AESV3).

PublicKeySeed

The explicit 20-byte recipient seed; no certificate/CMS decoding is performed.

PublicKeySubFilter

PublicKeyVersionValidation

ISO 32000-2:2020 pp.103–104/Table24, plus EC3 issue475 Completed, physical p.1021.

RandomSource

Randomness is supplied explicitly by the document's application.

Rc4Cipher

Historical RC4 primitive used by ISO 7.6.2–7.6.3, PDF pages 65–72.

RecipientDecrypter

Hardware, remote or native credentials are selected explicitly by the caller.

Revision5EncryptionDictionary

Standard handler V=5/R=5; supplement PDF pages 14–22, Algorithms 3.8–3.10.

Revision5Permissions

The signed P flags, with the reserved bits required by ISO 32000-1 Table 22.

Saslprep

RFC 4013 stored-string SASLprep: mapping, Unicode 3.2 NFKC, prohibitions and BIDI.

SignatureCmsInspection

Bounded inspection of the single-signer DER envelope emitted by the native PHP CMS backend.

SignatureDerElement

Limited DER inspection for the PDF signature envelopes delegated to RFC3852 by ISO12.8.3.

SignatureDerReader

Strict definite-length DER framing, without interpreting certificates, policies or PKI trust.

StandardCryptFilters

Explicit StrF, StmF and EFF selectors for the standard handler, ISO pp64–78.

StreamCryptFilter

Resolve an explicit first Crypt decoding filter (ISO 7.4.10, PDF page 54).

SystemRandomSource

Uses PHP's operating-system CSPRNG, without shared mutable state.

Unicode32SaslprepData

Frozen Unicode 3.2.0 data; generated by tools/build_saslprep_tables.py.

Unicode32SaslprepTables

Frozen, reproducible Unicode 3.2 data required by RFC 3454 and RFC 4013.

X509Certificate

Explicit DER X.509 bytes referenced by PDF signatures and recipient handlers; no certificate parsing or trust claim.