Bug 156835

Summary:	FILEOPEN XLSX Password protected file with SHA-384 encryption does not open
Product:	LibreOffice	Reporter:	Gabor Kelemen (allotropia) <kelemeng>
Component:	Calc	Assignee:	Balázs Varga (allotropia) <balazs.varga991>
Status:	VERIFIED FIXED
Severity:	normal	CC:	aron.budea, miguelangelrv
Priority:	medium
Version:	24.2.0.0 alpha0+
Hardware:	All
OS:	All
See Also:	https://bugs.documentfoundation.org/show_bug.cgi?id=148576
Whiteboard:	target:24.2.0 target:7.6.2
Crash report or crash signature:		Regression By:
Bug Depends on:
Bug Blocks:	143335
Attachments:	Example file from Excel 2019 Error message in Calc when trying to open the example Reference example file from MSO 2019 Standard. Pw: 1234 The second example in Calc

Description Gabor Kelemen (allotropia) 2023-08-21 10:12:28 UTC

Created attachment 189063 [details]
Example file from Excel 2019

Attached user made file has file open password set in Excel 2019.
Calc can not open this file, considers it as broken.

1. Open attached file
-> after a bit of thinking, Calc says it can not be opened because it's corrupt.

Version: 24.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: e60ef8651cfb30335471d1622e58c13eebc7d58b
CPU threads: 15; OS: Windows 10.0 Build 19045; UI render: Skia/Raster; VCL: win
Locale: en-US (hu_HU); UI: en-US
Calc: threaded

The interesting part is in the EncryptedInfo file inside, here:

<keyData saltSize="16" blockSize="16" keyBits="128" hashSize="48" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA384" 

<p:encryptedKey spinCount="100000" saltSize="16" blockSize="16" keyBits="128" hashSize="48" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA384" 

If I make a new similar password protected file in my Excel 2019 pro, then these look like:

<keyData saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" 

<p:encryptedKey spinCount="100000" saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512"

and LO can open this file just fine. So my guess the relevant difference is the SHA-384 vs SHA-512.

Note: this is not a duplicate of bug 148576 as Calc asks for the password of the example file there, and the above xml look like:

<keyData saltSize="16" blockSize="16" keyBits="128" hashSize="20" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA1" 

<p:encryptedKey spinCount="100000" saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512"

Comment 1 Gabor Kelemen (allotropia) 2023-08-21 10:13:03 UTC

Created attachment 189064 [details]
Error message in Calc when trying to open the example

Comment 2 Gabor Kelemen (allotropia) 2023-08-21 10:19:39 UTC

Created attachment 189065 [details]
Reference example file from MSO 2019 Standard. Pw: 1234

This opens just fine.

Comment 3 Gabor Kelemen (allotropia) 2023-08-21 10:21:35 UTC

Created attachment 189066 [details]
The second example in Calc

Comment 4 m_a_riosv 2023-08-21 16:02:49 UTC

Reproducible with first sample,

Version: 24.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 8b9643960117612b7e1cae1ed8325c2630232d0f
CPU threads: 16; OS: Windows 10.0 Build 22621; UI render: Skia/Raster; VCL: win
Locale: es-ES (es_ES); UI: en-US Calc: CL threaded

Microsoft® Excel® para Microsoft 365 MSO (versión 2307 compilación 16.0.16626.20170) de 64 bits, ask for the password.

Comment 5 Commit Notification 2023-08-30 12:35:18 UTC

Balazs Varga committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/9254fbce6b9e20a75aa2a379bcf2fc9dc41a5b44

tdf#156835 - FILEOPEN XLSX: add SHA-384 encryption support for ooxml import

It will be available in 24.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Comment 6 Commit Notification 2023-08-31 07:18:52 UTC

Balazs Varga committed a patch related to this issue.
It has been pushed to "libreoffice-7-6":

https://git.libreoffice.org/core/commit/3159296b3b033f2355a96b024c6834ad51321b75

tdf#156835 - FILEOPEN XLSX: add SHA-384 encryption support for ooxml import

It will be available in 7.6.2.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Comment 7 m_a_riosv 2023-09-03 16:35:21 UTC

Verified
Version: 24.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 3c7a35dd28fbc337a23473873b3dd47392b883ae
CPU threads: 16; OS: Windows 10.0 Build 22621; UI render: Skia/Raster; VCL: win
Locale: es-ES (es_ES); UI: en-US Calc: CL threaded Jumbo
Version: 7.6.2.0.0+ (X86_64) / LibreOffice Community
Build ID: a453cafde419d186625c191154d8d6178f0149d0
CPU threads: 16; OS: Windows 10.0 Build 22621; UI render: Skia/Raster; VCL: win
Locale: es-ES (es_ES); UI: en-US Calc: CL threaded