{"record":{"id":"33697451170c1ae5","repo":"mozilla/pdf.js","slug":"unknown-encryption-method","errorCode":null,"errorMessage":"unknown encryption method","messagePattern":"unknown encryption method","errorType":"exception","errorClass":"FormatError","httpStatus":null,"severity":"error","filePath":"src/core/crypto.js","lineNumber":1064,"sourceCode":"    key[i++] = num & 0xff;\n    key[i++] = (num >> 8) & 0xff;\n    key[i++] = (num >> 16) & 0xff;\n    key[i++] = gen & 0xff;\n    key[i++] = (gen >> 8) & 0xff;\n    if (isAes) {\n      key[i++] = 0x73;\n      key[i++] = 0x41;\n      key[i++] = 0x6c;\n      key[i++] = 0x54;\n    }\n    const hash = calculateMD5(key, 0, i);\n    return hash.subarray(0, Math.min(n + 5, 16));\n  }\n\n  constructor(dict, fileId, password) {\n    const filter = dict.get(\"Filter\");\n    if (!isName(filter, \"Standard\")) {\n      throw new FormatError(\"unknown encryption method\");\n    }\n    this.filterName = filter.name;\n    this.dict = dict;\n    this.#fileId = fileId;\n    const algorithm = dict.get(\"V\");\n    if (\n      !Number.isInteger(algorithm) ||\n      (algorithm !== 1 && algorithm !== 2 && algorithm !== 4 && algorithm !== 5)\n    ) {\n      throw new FormatError(\"unsupported encryption algorithm\");\n    }\n    this.algorithm = algorithm;\n    let keyLength = dict.get(\"Length\");\n    if (!keyLength) {\n      // Spec asks to rely on encryption dictionary's Length entry, however\n      // some PDFs don't have it. Trying to recover.\n      if (algorithm <= 3) {\n        // For 1 and 2 it's fixed to 40-bit, for 3 40-bit is a minimal value.","sourceCodeStart":1046,"sourceCodeEnd":1082,"githubUrl":"https://github.com/mozilla/pdf.js/blob/5903d58d58e4dd9ce6ffa3834aea8480f06b4ada/src/core/crypto.js#L1046-L1082","documentation":"Thrown by the CipherTransformFactory constructor when the encryption dictionary's Filter entry is not the name 'Standard'. PDF.js only implements the Standard security handler defined by the PDF spec; any other handler (public-key/PKI handlers like Adobe.PPKLite, custom plug-in handlers, or a missing/malformed Filter entry) is rejected up front. The PDF cannot be decrypted and parsing of encrypted streams will not proceed.","triggerScenarios":"Opening a PDF whose /Encrypt dict carries Filter /Adobe.PPKLite or another non-Standard name; opening a PDF whose /Encrypt dict has no Filter entry at all; loading a password-protected PDF produced by a tool that emits a proprietary security handler. Constructed indirectly via PDFDocument/CipherTransformFactory during initial encrypted-document setup.","commonSituations":"Certificate-encrypted (PKI) PDFs from enterprise signing tools; PDFs encrypted by DRM or rights-management plug-ins; rarely, a truncated Encrypt dict from a corrupt download. There is no API flag to bypass this—the handler is simply unsupported.","solutions":["Re-save the PDF with Standard security (RC4/AES) using Acrobat, qpdf --decrypt, or another tool, then reload it.","If you control generation, configure the producer (e.g., iText, reportlab, LibreOffice) to use the Standard security handler rather than certificate encryption.","Pre-scan PDFs and surface a clear 'unsupported encryption' message to end users instead of letting the raw FormatError propagate."],"exampleFix":"// before\nconst task = getDocument({ url });\n\n// after — detect non-Standard encryption up front and inform the user\ntry {\n  const task = getDocument({ url });\n  const doc = await task.promise;\n} catch (e) {\n  if (e.message === 'unknown encryption method') {\n    throw new Error('This PDF uses a non-Standard security handler (e.g. certificate encryption) and cannot be opened.');\n  }\n  throw e;\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const doc = await getDocument({ url }).promise;\n} catch (e) {\n  if (e.name === 'FormatError' && e.message === 'unknown encryption method') {\n    notifyUser('Unsupported security handler (only Standard encryption is supported).');\n    return;\n  }\n  throw e;\n}","preventionTips":["Maintain an allow-list of accepted producers; reject PKI/certificate-encrypted PDFs at upload time.","Pre-scan incoming PDFs for the /Encrypt Filter entry and classify before dispatching to the viewer.","Document for end users that certificate-encrypted PDFs are not supported."],"tags":["encryption","pdf-security","format-error","unsupported-feature"],"backgroundTag":null,"analyzedSha":"5903d58d58e4dd9ce6ffa3834aea8480f06b4ada","analyzedAt":"2026-08-13T02:28:27.364Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}