How does SumatraPDF store passwords?

[vishalnandagopal]

When I click click on "save password" when typing the password for a file, a parameter DecryptionKey appears in SumatraPDF-settings.txt.

What is the encryption process? Is it just something like base64?

[kjk]

Possibly hex-encoded but really I forgot the details. You can always look at the code.

[vishalnandagopal]

sumatrapdf/do/settings_def.go

Lines 168 to 172 in 96fca37

	mkField("DecryptionKey", String, nil,
	"Hex encoded MD5 fingerprint of file content (32 chars) followed by "+
	"crypt key (64 chars) - only applies for PDF documents").setDoc("data required to open a password protected document without having to " +
	"ask for the password again"),
	mkField("UseDefaultState", Bool, false,

"Hex encoded MD5 fingerprint of file content (32 chars) followed by "+"crypt key (64 chars) - only applies for PDF documents"

So the first part is clear and I manually tested it, do you know what the crypt key is?

[kjk]

I'm pretty sure it's password

[GitHubRulesOK]

@vishalnandagopal
It is not as simple as "base64" since coded length is no indication of number of characters
one letter password is
36280035e9f422e34c31b7cc455ac71026027a544f3be5fbe55781f65943bd9200000000000000000000000000000000
and eight letters is
c07adc198d89bee6bf53ea292f7c3217fe91f15bda233bc15dce25bde5e4abbb00000000000000000000000000000000

4 digits is easier
dc4eabcc07eef6f69f0d33d0c29457635139b4213a000000000000000000000000000000000000000000000000000000
but it is not the PDF file internal hash key which is longer
E72D0940E6DD12AF935A08BEA7B46B2CDA6F53F3173A9F403602F0ABD34DCEE8

so it may be a simpler cypher reflecting user input.
However comments in code says

// Store a password securely (if data encryption is provided by OS)
// or obfuscated to make search for password in memory dump less trivial.

and in part may be from MuPDF code base too as that says "padding"

[vishalnandagopal]

Okay thanks, will take a look at the code and see if I can figure it out