Headless encrypted incremental updates

The native document writer preserves the loaded encryption dictionary, document IDs, passwords and permissions when publishing supported encrypted incremental edits and signatures

Supported security policies

The profile covers Standard RC4 R2/R3, Standard V4/R4 crypt filters using Identity, V2 or AESV2, and AES-256 R5/R6; the AES-256 provider retains its existing API while the document loader selects the appropriate supported provider

R2/R3/R4 passwords use PDFDocEncoding and the legacy 32-byte limit; unrepresentable characters produce a password diagnostic rather than a system-codepage substitution, while R5/R6 passwords use UTF-8 truncated at 127 bytes without SASLprep normalization

User authentication retains operation-specific permission checks, and owner authentication bypasses user permission restrictions without changing the output permission policy

Object-aware writing

String and stream encryption receives the destination object number and generation explicitly; new appearance, font, field and signature objects use their planned destination identities rather than ambient cryptographic state

Compressed object members are decrypted with their object-stream container once; a member materialized as a direct incremental replacement uses its own destination object identity and generation

Loading, reading and later rewriting an encrypted stream does not encrypt an already encrypted source payload a second time; the writer applies the current selected stream filter to the plaintext replacement

RC4 ciphertext retains the plaintext byte count; AESV2 includes its 16-byte IV and PKCS7 padding, and cipher-size admission follows the actual selected algorithm before output allocation

R4 crypt-filter selection

StrF and StmF select string and stream filters and default to Identity when absent; EFF selects embedded-file streams and defaults to StmF

For Standard AESV2, the crypt-filter Length is 16 bytes; the object key includes the object number, generation and sAlT marker, while EncryptMetadata=false adds the required file-key suffix and keeps metadata streams clear under default stream selection

An explicit Crypt filter must be first in a stream filter chain; its DecodeParms Name selects the crypt filter and defaults to Identity when absent

Optional stream Filter, DecodeParms, Type and Name values that resolve to null have the same default behavior as missing entries, including indirect null values resolved through the document

Encryption-dictionary and crypt-filter dictionaries retain their direct-object requirements; an unused null filter member is absent, while a selected missing filter, a required missing value or an invalid non-null type remains an error

Incremental signatures and publication

The writer preserves the complete original source prefix and authenticated prior signature revisions; replacement objects and trailers are appended through the shared incremental writer

Signature metadata, FieldMDP names and appearance resources follow their selected encryption policy; only signature Contents is exempt from PDF encryption, and its actual bytes remain part of signature and committed-state comparisons

Exact ByteRange gaps, CMS integrity, CAdES certificate binding and explicit trust policy remain independent checks; successful PDF publication does not by itself establish certificate trust

A successful callback-ABI mutation commits the prepared document as the handle's current source; a later signature uses that revision, while cancellation or binary/result callback failure leaves the prior committed document available for a retry

Caller-owned callbacks may already have consumed bytes when a later callback fails; callers that need external rollback must stage their own output

Ordinary SaveToFile and save-to-I/O operations serialize an incremental PDF rather than return a byte-identical snapshot, and still enforce authenticated modification policies

Limits and boundaries

Existing object, decoded-byte, working-byte, operation, output and cancellation limits remain active through cryptographic processing and serialization; temporary cryptographic and unpublished output state is released on failure

The profile does not convert encryption handlers, rekey documents, remove protection, or add public-key security handlers, AES-GCM or PDF MAC support

Incremental saving · Native signing · Callback signing workflows · Authenticated field locks