Question

Is it possible to configure the FlexPaper reader to decrypt password-protected PDFs or SWFs?

Here is the use-case:

1. User uploads a PDF.
2. My server would then convert the PDF to SWF via pdf2swf.
3. Then somehow encrypt the SWF with a password (not sure best way to do this).
4. Then the FlexPaper would be able to decrypt the SWF and display it.

What I am trying to avoid is the caching of readable SWF in the browser’s cache.

Any ideas on the best way to achieve this?

I know, even with this it will not be a fully secure solution, but certainly helps.

Note: I am running this on Linux and OS X and using Rails.

Answers from questions asked in the responses:

• Do you need it on the wire?

  No, I don’t think so, the application will be only accessed via SSL

• Do you need the files to be stored securely on your hard drive?

  Ideally yes, we will keep them encrypted on the server — but not critical

• What exactly are you trying to prevent by encrypting them?

  I want users of the application only to be able to view the documents from the FlexPaper reader on the website. I do not want users to be able to download a readable document to their machine.

Thanks!

Jonathan

Answer 1

What I am trying to avoid is the caching of readable swf in the browser’s cache.

I’m not sure if using a password will help at all. If the SWF is encrypted it may likely be stored in the cache encrypted. I think this post on how to prevent caching is probably what you want.

But in case not, I’ll answer some of the encryption questions below.

pdf2swf supports a -P (or --password) option that allows you to decrypt an encrypted PDF, which implies you need a password fairly early in that process.

If you want to encrypt the SWF, you should check out the as3crypto libraries for the Flex side and some ruby crypto libraries for the server side.

I have a blog post entitled, “Why Obfuscate, Encrypt those SWFs! that talks about how you can encrypt a SWF that is then decrypted via a SWFLoader that I hope is useful to you. The same concepts apply here:

1. Encrypt the SWF (after it’s been converted from PDF)
2. Use a modified SWFLoader (or URLLoader) to decrypt the SWF
3. Use the decrypted SWF just like you would a regular one

But, a few questions:

Where do you need security? Do you need it on the wire? Do you need the files to be stored securely on your hard drive? What exactly are you trying to prevent by encrypting them? The answers to these questions will largely determine the best approach to take.