From ad5ef55b30d18ee2b63ad93403254f1b211fed6f Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Fri, 6 Nov 2026 14:20:16 -0800 Subject: [PATCH] Docs: PDF password export says when the file ID and the bytes vary Encryption keeps the /ID already in the trailer and draws one from the seed only when there is none. A PDF 1.3 export draws no random bytes, so it repeats with SOURCE_DATE_EPOCH set, while PDF 1.4 and later differ between runs. Their random bytes are in the encryption dictionary and, at PDF 1.6 and later, in the AES initialization vectors. --- docs/mcp.md | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/docs/mcp.md b/docs/mcp.md index c3890b89f..0ad6ad8fc 100644 --- a/docs/mcp.md +++ b/docs/mcp.md @@ -1068,10 +1068,15 @@ A command that takes its own date (`file.new {created}`, a save's `modified`) st variable. A blank, negative or non-numeric value is ignored and the clock decides, so an export is never refused over the environment. SVG output carries no time and was already reproducible. -Two things stay on the real clock and are not pinned by the variable: the recovery heartbeat, and -the random seed PDF encryption draws on. **A PDF exported with a password therefore still differs -between runs** whatever `SOURCE_DATE_EPOCH` says, because that seed supplies its AES -initialisation vectors and its file `/ID`. Reproducible output means an unencrypted export. +Two things are not pinned by the variable: the recovery heartbeat, which stays on the real clock, +and the random seed PDF encryption draws on, which mixes the OS random source with the clock. **A +PDF exported with a password at PDF 1.4 or later therefore still differs between runs** whatever +`SOURCE_DATE_EPOCH` says, because that seed supplies random bytes in its encryption dictionary and, +at PDF 1.6 and later, its AES initialization vectors. Encryption at PDF 1.3 (RC4 40-bit) draws +nothing from the seed, so that export repeats with the variable set. Encryption keeps the file `/ID` +the export already wrote, which also repeats with the variable set; the seed supplies an `/ID` only +for a file that has none. Reproducible output means an unencrypted export or a password-protected +PDF 1.3 export. ### Parameter keys