[Password Section]
Password Section
This sextion is found in documents that have been encrypted with a password. Its contents is not yet fully decoded. It is 29 bytes long.
Size Data Description
B Always A2 ?
W Always 01 00 ?
W Checksum ?
L «ID» Always 03 01 00 10 ?
20B Encrypted password
Presumably, the plaintext password is put through a (one-way?) hash function and the result is put in this section.
[Encrypted Sections]
Encrypted Sections
If a file is encrypted by a password, only a few sections will actually be encrypted:
Filetype Section ID Section Name
«Word File» 10000106 «Text Section»
«Sheet File» 1000011D
10000121 «Sheet Graph List Section»
[Encryption Method]
Encryption Method
The plaintext is separated into blocks of 20 bytes. The last block is padded with bytes containing 30. Each block is encypted by adding a 20 byte long key. This key is somehow based on the plaintext password (probably through a similar, though different, hash function as that which is used to encrypt the password), and it is the same for each block.
The resulting encryption seems to be fairly weak. For a word file, for example, you can gather a lot of information from the other (unencrypted) sections; for a longer text, this is probably enough to break the encryption key, without ever needing the plaintext password! This could even be automated somewhat: if there is a Paragraph Element List, you know the length of each paragraph; you also know that (almost) all paragraphs end with a 06 byte.