Re: workbook encryption (password protection)

[Nicholas Lamb <njl ecs soton ac uk>]

On Tue, May 02, 2006 at 09:52:43PM -0400, Morten Welinder wrote:
> Currently you have to use external tools.  (And forget about the
> Excel encryption unless you just want to keep secrets from your
> kid sister.)

Certainly the XLS variant we currently speak is suitable for Excel-compatible
encryption that is safe unless your kid sister works for the NSA.

There are three levels, which have names, but I'll just call them #1-3

#1 is trivial, although your kid sister would need to be a mathematical
prodigy or have access to existing cryptographic techniques in order to
break it herself, she could just download my 'xlcrack' program and use it.

This level (#1) is the only level available in any French version due to
ridiculous laws.

#2 is Microsoft's replacement, and the level used by most XL users today
who don't know how to change the defaults. It is computationally weaker
than one would like for a new system today, but your kid sister will not
break it unless you choose a bad password. Some 3rd party data recovery
companies sell a service to break this password using a compute cluster.

#3 is the best available in recent XL versions, and is based on a real
Windows system wide encryption service, although it should be trivial
for us to reverse engineer it if need be. This is strong enough that
your only hope is to brute force it or know something about crypto that
is not public knowledge (e.g. hypothetical NSA back door)


IMNSHO supporting #2 for Gnumeric exported XLS files would be a useful
feature, though obviously the French situation could be a problem.

Nick.