The Microsoft Excel File Format - OpenOffice.org

4.19 File Protection
4.19 File Protection
A file might be protected with a password against modifying (write protection), or against opening at all (read/write
protection). These passwords are set in the Save-As dialogue of Excel.
• Write protection (BIFF3-BIFF8): The WRITEPROT record marks the file to be protected against modifying. The
password to unprotect the file is stored in the FILESHARING record. Write protection does not cause to encrypt the
file.
• Read/write protection (BIFF2-BIFF8): A FILEPASS record occurs containing stream encryption information, which
includes the encrypted password. All following records are encrypted (➜4.19.1).
Definition: File Protection Block
The records of the File Protection Block describe the file protection and are the first records in a file (➜4.2).
Structure of the File Protection Block:
○
WRITEPROT
File is write protected (BIFF3-BIFF8, ➜5.113), password in
FILESHARING
○ FILEPASS File is read/write-protected, encryption information (➜5.43)
○ WRITEACCESS User name (BIFF3-BIFF8, ➜5.112)
○ FILESHARING File sharing options (BIFF3-BIFF8, ➜5.44)
4.19.1 BIFF2-BIFF5 XOR Stream Encryption
Encryption takes place for the contents of a record. The record header (record identifier and size) is not encrypted. There
are a few records or data fields that are never encrypted either:
• The entire BOF record (➜5.8)
• The entire INTERFACEHDR record
• The stream position field in the SHEET record (➜5.95)
Stream encryption takes place in several steps:
4) get the password from the user
5) create hash value (16-bit, ➜4.18.4) and encryption key (16-bit, see below) from the password
6) store hash value and encryption key in FILEPASS record (➜5.43)
7) create the 128-bit sized key sequence from password and encryption key (see below)
8) encrypt all following records using the key sequence (see below)
Stream decryption works similar to encryption:
9) get the password from the user
10) create hash value (16-bit, ➜4.18.4) and encryption key (16-bit, see below) from the password
11) compare with values contained in FILEPASS record
12) if password is correct, create the 128-bit sized key sequence from password and encryption key (see below)
13) decrypt all following records using the key sequence (see below)
117