THPDFHeadlessAES256Security

This class in HPDFHeadlessSecurity authenticates Standard V=5 encryption dictionaries with R=5 or R=6 and AESV3 DocOpen crypt filters using the shared HotPDF cryptographic implementations

Create(EncryptionDictionary, Password, CancellationToken) accepts a caller-owned dictionary, a Unicode password and an optional caller-owned cancellation token; passwords use UTF-8 bytes truncated at 127 bytes, with no SASLprep normalisation

Owner authentication is tried before user authentication, OE or UE recovers the 256-bit file key, and Perms authenticates the permission mask and EncryptMetadata policy; destruction clears the retained key

DecryptString and EncryptString follow StrF, while DecryptStream(Data, IsMetadata) and EncryptStream(Data, IsMetadata) follow StmF and EncryptMetadata; IsMetadata defaults to false, Identity leaves bytes unchanged, and encrypted payloads carry a fresh 16-byte IV and PKCS7 padding

RequireTextExtractionPermission checks permission bit 5, and RequireFormFillPermission checks bit 9; authenticated owner passwords bypass these user permission restrictions

Read-only properties are Revision, OwnerAuthenticated, PermissionMask, EncryptMetadata, EncryptStrings and EncryptStreams

Failures raise EHPDFHeadlessSecurityError; cancellation retains EHPDFOperationCancelled, and callers must apply xref, object-stream, encryption-dictionary, trailer-ID and signature Contents exceptions when using this provider directly

RC4, AES-128, public-key handlers, AES-GCM, explicit stream Crypt filters and PDF MAC validation require separate policies; this provider does not create encryption dictionaries or change document permissions