.KEY File Format – Package and encryption

Apple Keynote presentation

Apple has not published the Keynote format. This page follows Sean O’Brien’s iWorkFileFormat project, which describes the iWork ’13 format used by Keynote 6 and later, using a Keynote presentation as its example, and its iWorkFileInspector source code. The objects inside the files are on the IWA archives page. Keynote ’09 and earlier used an XML format that is not described here.

Bundle and single file

A Keynote presentation is either a bundle, a macOS package folder named ….key, or a single file, a ZIP archive of the same files. In the bundle the objects are in a file Index.zip; in a single-file presentation the ZIP holds the Index/ folder of .iwa files directly.

Photo Essay.key/
  Data/
    143917994_2881x1992-small.jpg
    143918632_1620x1622-small.jpg
    …
  Index.zip              (in a bundle; Index/… entries in a single-file presentation)
  Metadata/
    BuildVersionHistory.plist
    DocumentIdentifier
    Properties.plist
  preview-micro.jpg
  preview-web.jpg
  preview.jpg

This is the example iWorkFileFormat gives.

Files

PathContents
Index.zip or Index/The presentation’s objects, one .iwa file per component. iWorkFileFormat’s listing shows Document.iwa, DocumentStylesheet.iwa, AnnotationAuthorStorage.iwa, CalculationEngine.iwa and one file per master slide, MasterSlide-1.iwa, MasterSlide-2.iwa and so on, among others.
Data/Pictures, movies and sounds used on the slides.
Metadata/Properties.plistDocument properties, as a property list; iWorkFileInspector reads its documentUUID and versionUUID strings.
.iwpv2, .iwphOnly in a password-protected presentation: the password verifier and the password hint (see below).
Metadata/BuildVersionHistory.plistThe builds of Keynote that have saved the presentation.
Metadata/DocumentIdentifierA unique identifier of the presentation.
preview.jpg, preview-web.jpg, preview-micro.jpgPreview images in three sizes (JPEG).

Index.zip

The ZIP writer iWork uses for Index.zip stores files without compression (the .iwa files are already compressed) and supports no Zip64 or other extensions. Repacking it with an ordinary ZIP tool can make a presentation Keynote will not open. iWorkFileFormat suggests one ZIP file is used so that saving locks a single file rather than many small ones.

Password encryption

When a presentation has a password, nearly every file in it is encrypted with AES-128 in CBC mode with PKCS#7 padding. The bundle then holds a password verifier, a 104-byte file named .iwpv2 at the top of the bundle, and may hold the password hint as UTF-8 text in a file named .iwph (the names are those iWorkFileInspector’s IWBundle.m reads):

OffsetSizeFieldMeaning
02Version2.
22Format1.
44IterationsPBKDF2 iteration count.
816SaltPBKDF2 salt.
2416IVInitialisation vector for checking the key.
4064Check dataEncrypted check block.

Numbers are little-endian; iWorkFileInspector refuses any verifier whose version is not 2 or whose format is not 1, and any file that is not exactly 104 bytes. The 16-byte key is PBKDF2 with HMAC-SHA-1 over the password’s UTF-8 bytes with this salt and count. It is right when decrypting the check data (AES-128-CBC, no padding, the verifier’s IV) gives 64 bytes whose last 32 are the SHA-256 of the first 32.

Each encrypted file is a 16-byte IV, the ciphertext, and 20 trailing bytes, which the inspector’s source calls “garbage” and skips; their purpose is not explained in any public source. The inspector decrypts each .iwa entry it reads from Index.zip this way before the Snappy step. The first 16 bytes of the decrypted text are discarded. As iWorkFileFormat’s write-up of this is still “forthcoming”, these details come from its inspector’s source code.