Bug 148576 - Calc doesn't open XLSX file with AES 256-bit password
Summary: Calc doesn't open XLSX file with AES 256-bit password
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
5.2.7.2 release
Hardware: All Windows (All)
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: filter:xlsx
Depends on:
Blocks: XLSX-Doc-Protection
  Show dependency tree / graph
 
Reported: 2022-04-13 17:02 UTC by michel.pamboukian
Modified: 2023-08-21 11:15 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:

Attachments
contains confidential data (deleted)
2022-04-13 17:04 UTC, michel.pamboukian 		Details
Sanitized sample with password 1234 (15.00 KB, application/vnd.openxmlformats-officedocument.spreadsheetml.sheet)
2022-04-13 17:53 UTC, Mike Kaganski 		Details
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description michel.pamboukian 2022-04-13 17:02:51 UTC 
Description:
Dear all,

   I changed my computer few days ago and I am running Windows 11. The problem remains.

       The file concerned is attached. 

  The password    anemonE7  is accepted but the file is not opened. Please make sure that the file

    is deleted after use because it contains confidential data.    I might doing  something wrong.    

     Thank you and best regards,

     mp 

Actual Results:
File not openned

Expected Results:
open the file


Reproducible: Always


User Profile Reset: No



Additional Info:
 file concerned attached
Comment 1 michel.pamboukian 2022-04-13 17:04:22 UTC Comment hidden (obsolete)
Comment 2 Mike Kaganski 2022-04-13 17:53:40 UTC 
Created attachment 179540 [details]
Sanitized sample with password 1234

Repro using Version: 7.3.2.2 (x64) / LibreOffice Community
Build ID: 49f2b1bff42cfccbd8f788c8dc32c1c309559be0
CPU threads: 12; OS: Windows 10.0 Build 19044; UI render: default; VCL: win
Locale: ru-RU (ru_RU); UI: en-US
Calc: 

This file has *everything* (including hidden data and metadata) removed using Excel 2016 (all original sheets are removed, and a new empty sheet added); the new password is 1234. The resulting file doesn't open after entering the password.
Comment 3 Buovjaga 2022-04-13 18:08:18 UTC Comment hidden (obsolete)
Comment 4 Roman Kuznetsov 2022-04-13 20:08:22 UTC Comment hidden (obsolete)
Comment 5 Mike Kaganski 2022-04-14 08:45:19 UTC 
(In reply to Roman Kuznetsov from comment #4)
> Confirm in 7.4 and in 5.2.7.2

Not exactly. Before 6.2, all versions behave differently: they ask for password repeatedly several times, after which (if not cancelled) the file is opened in Writer (showing junk).

The related change is commit ce560ee99ebf97fa44aecedd5110b29913cf77a5
  Author Tomaž Vajngerl <tomaz.vajngerl@collabora.co.uk>
  Date   Wed Jul 04 22:23:44 2018 +0200
    oox: Agile encryption and data integrity verification

Note that regardless, this is not a regression of any kind; it could never be opened.
Comment 6 Timur 2022-04-26 09:19:03 UTC Comment hidden (obsolete)
Comment 7 Michael Warner 2022-04-27 03:28:50 UTC 
(In reply to Timur from comment #6)
> This is AES 256-bit encryption. Lo has multiple bugs for opening AES PDF.
> If XLSX is saved in MSO as XLS, it's with a weak encryption so it opens in
> LO.

Opening an AES-256 encrypted PDF will leverage xpdf and of necessity be a different solution from opening an AES-256 encrypted XLSX. Despite the superficial similarity of the problem statements, there is not a common root cause between the two so I don't expect there to be any significant overlap in the resolution.
Comment 8 Pedro Côrte-Real 2023-06-04 22:13:39 UTC 
I'm seeing the exact same problem on 7.4.7 as shipped by Ubuntu 22.10.1