A presentation with a password to open it is an encrypted file. It uses the Office Binary Document RC4 CryptoAPI method, specified in [MS-OFFCRYPTO]; [MS-PPT] allows no other.
How to tell
- The
headerTokenof the CurrentUserAtom is 0xF3D1C4DF instead of 0xE391C05F. - The newest UserEditAtom has the optional field
encryptSessionPersistIdRef, which is the persist id of a CryptSession10Container.
What is and is not encrypted
| Part | State |
|---|---|
| Current User stream | Not encrypted. |
| UserEditAtom and PersistDirectoryAtom | Not encrypted. A file has exactly one UserEditAtom. |
| CryptSession10Container (type 0x2F14) header | Not encrypted. Its body is an EncryptionHeader, encrypted. |
| The rest of the PowerPoint Document stream | Encrypted, one persist object at a time, with a key made from the persist id. |
| Pictures stream | Encrypted. |
| SummaryInformation and DocumentSummaryInformation | Depends on the fDocProps flag: without it, the summary is in an EncryptedSummary stream; with it, the normal streams are left readable. |
The explorer identifies such a file and shows the records that can be read. It does not ask for a password or decrypt anything.
Reference
- [MS-OFFCRYPTO] – Microsoft’s specification of Office document cryptography