What OOXML can I enter in a PPTX to password protect the presentation?

Question

I have a PPTX and I want to make it password protected programatically by inserting OOXML. When I try to check the Diff of a non-protected and protected document, the files in the password protected OOXML are encrypted and the only line that is human readable which I find in EncryptionInfo doesn't seems to make a difference in my output when placed in the header (method has been used and worked in DOCX and XLSX). The precise steps I have taken are to attempt writing the exact XML snippet below into the w:documentProtection XML into the presentation.xml file wihing the presentation OOXML. The line I was able to find and attempted to use is

<encryption xmlns="http://schemas.microsoft.com/office/2006/encryption" xmlns:p="http://schemas.microsoft.com/office/2006/keyEncryptor/password" xmlns:c="http://schemas.microsoft.com/office/2006/keyEncryptor/certificate"><keyData saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="PsN9IUU1oJmcsDaUVt60jw=="/><dataIntegrity encryptedHmacKey="me26S0uLwwSIu+NW8PVASbKe7PEmQmSoLBpPs2dlHuo+iVK6mp+CjANO14Jylg8OKEv7b0kuCS0QZlOdVdNwdw==" encryptedHmacValue="C4rKQnpdr57Y8YP7b51MbJ+2++I8jJEjhaDKUeMJEqcI94d+3EcSSRaT8QZT/8kNMMIUsIb9nQz5caam/uOZ7A=="/><keyEncryptors><keyEncryptor uri="http://schemas.microsoft.com/office/2006/keyEncryptor/password"><p:encryptedKey spinCount="100000" saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="12iX0LrGmamKXhk/lyvE2w==" encryptedVerifierHashInput="6kQNg3TeSwcmsZwF+Hze2w==" encryptedVerifierHashValue="mQvtKWbOwmvkTI40mxOAUXE/umUXZ08/9PKAVpixWzBtn3LmUarxwd/EFXK2nYRqa3W50/1bKiC6VovW0x9TLQ==" encryptedKeyValue="2TQY5R3eV/7IXGMxfyPVbCwyaCERpK8bKcuf7RNau4M="/></keyEncryptor></keyEncryptors></encryption>

Answer 1

Hi Ian Peterson,

Thanks for the clarification. The element you need to add password for editing is the p:modifyVerifier. It needs to be added to the presentation.xml part and it should be an immediate child of the p:presentation element and it must come before any extList elements in the part. It should be similar to this:

<p:modifyVerifier cryptProviderType="rsaAES" cryptAlgorithmClass="hash" cryptAlgorithmType="typeAny" cryptAlgorithmSid="14" spinCount="100000" saltData="ZkNVQ370CHOj5dkCeIwdxQ==" hashData="gIJEhXtNejdlCNvTxQgppRNRgbEX5Hojrupnna1NLCI77wFVhDFHWZV2AOz/RMQi7aOUe9dzd8DOQdbNbR7Biw=="/>

Please note, however, this does not encrypt the file and can be easily undone by removing the element from the xml.

When a password protected document is created in the Office User Interface (UI) becomes a Microsoft Compound File Binary File Format (MS-CFB) document (not a ZIP package), though the file extension does not change (e.g., xlsx, docx, pptx). Subsequently, the UI protected document will open within the Office UI but you cannot rename the file extension to *.zip and browse it with Explorer.

This is not what happens when you add an element to the xml part. When you add the p:modifyVerifier element to a pptx (or the other elements for docx and xlsx), PowerPoint (or Word or Excel) will require a password to open the pptx for editing, but it if a user edits the xml and removes the p:modifyVerifier element then no password will be required for editing.

Best Regards,

Michael Bowen

Senior Escalation Engineer - Microsoft Open Specifications