Open AES-Encrypted PDF in Swift for iOS

1
//
2
//  Copyright © 2015-2025 PSPDFKit GmbH. All rights reserved.
3
//
4
//  The Nutrient sample applications are licensed with a modified BSD license.
5
//  Please see License for details. This notice may not be removed from this file.
6
//
7

8
import PSPDFKit
9
import PSPDFKitUI
10

11
class AESCryptoDataProviderExample: Example {
12

13
    override init() {
14
        super.init()
15
        title = "PSPDFAESCryptoDataProvider"
16
        contentDescription = "Example how to decrypt a AES256 encrypted PDF on the fly."
17
        category = .security
18
    }
19

20
    override func invoke(with delegate: ExampleRunnerDelegate) -> UIViewController {
21
        let encryptedPDF = AssetLoader.assetURL(for: "AES-Encrypted.pdf.aes")
22

23
        // Note: For shipping apps, you need to protect this string better, making it harder for hacker to simply disassemble and receive the key from the binary. Or add an internet service that fetches the key from an SSL-API. But then there's still the slight risk of memory dumping with an attached gdb. Or screenshots. Security is never 100% perfect; but using AES makes it way harder to get the PDF. You can even combine AES and a PDF password.
24
        let passphrase = "afghadöghdgdhfgöhapvuenröaoeruhföaeiruaerub"
25
        let salt = "ducrXn9WaRdpaBfMjDTJVjUf3FApA6gtim0e61LeSGWV9sTxB0r26mPs59Lbcexn"
26

27
        // Nutrient doesn't want to keep the passphrase in memory any longer than it has to. This is the reason we use a passphrase provider.
28
        // For optimal results, always fetch the passphrase from secure storage (like the keychain) and never keep it in memory.
29
        let passphraseProvider = { passphrase }
30

31
        guard let cryptoWrapper = AESCryptoDataProvider(url: encryptedPDF, passphraseProvider: passphraseProvider, salt: salt, rounds: AESCryptoDataProvider.defaultNumberOfPBKDFRounds) else {
32
            return PDFViewController(document: nil)
33
        }
34

35
        let document = Document(dataProviders: [cryptoWrapper])
36
        document.uid = encryptedPDF.lastPathComponent // Manually set a UID for encrypted documents.
37

38
        // `PSPDFAESCryptoDataProvider` automatically disables `useDiskCache` to restrict using the disk cache for encrypted documents.
39
        // If you use a custom crypto solution, don't forget to disable `useDiskCache` on your custom data provider or on the document,
40
        // in order to avoid leaking out encrypted data as cached images.
41
//        document.useDiskCache = false
42

43
        return PDFViewController(document: document)
44
    }
45
}