Read this article in French.
It is very easy to protect and secure PDF files and electronic documents and prevent unauthorized access. You can for instance add an electronic signature, add a password, and remove sensitive content from your PDFs with the free AvePDF online tools.
Table of Contents
In today’s article, I will give you three tips to easily secure your PDF files and their content.
The document you want to secure is an image and other types of documents that are not in PDF? Before anything else, you can convert or combine your files into PDF.
Then, depending on your needs, you can perform one or several actions to protect your file and its content. You could, for instance,
- add a signature
- add a password
- remove sensitive content
Let’s learn more about each strategy.
The electronic signature
The term “electronic signature” or “digital signature” actually describes several different concepts. Because there isn’t only one type of electronic signature available, and all signatures are not equal.
There are 3 types of electronic signatures authorized by eIDAS (at the European level): simple, advanced, and qualified.
In all cases, the goals of the electronic signature are:
- Integrity: assurance that the document has not been modified somewhere in the workflow.
- Authenticity: assurance that the document’s signatory is who we think we are (and not someone else).
- Non-repudiation: assurance that the signatory cannot refuse his signature.
On the contrary to Europe, the US laws (UETA Act and the E-Sign Act) do not distinguish between different types of electronic signatures according to their level of security. What is important is the intent to sign.
Simple electronic signature
The simple electronic signature is adapted to everyday acts or those with low legal or financial consequences for the signatory. It can be an actual drawing of your signature, done with the mouse or touch-pad, or an image of your signature.
Advanced electronic signature
It includes using a digital certificate, an electronic document issued by a Certificate Authority. Its purpose is to validate the identity of the user.
Qualified electronic signature
Generally used for authentic acts of notaries, lawyers, bailiffs, courts, etc. A government-approved certification authority must verify and validate the identity of the signer.
Timestamps
Often there is an option to timestamp the signature, meaning that the date and exact time of the signature will be added to the document. The digital timestamp can be issued by a trusted authority like the digital certificate, but many solutions provide their own.
Which electronic signature should I use?
Remember, depending on the context, it is not mandatory to have the highest level of electronic signature. In most cases (or in other words, when you don’t deal with the legal system), you will need either a simple or advanced signature.
The AvePDF Esign PDF widget supports both types, thanks to the ability to import a digital certificate.
What does the PDF specification say about e-signature?
For the PDF specification, the security of the electronic signature process is provided by asymmetric cryptography (public/private key), the SHA-256 hash algorithm, and time stamp (section 12.8.5 PDF 2.0).
Try our AvePDF Esign widget!
PDF encryption with a password
Another useful tool to secure PDF documents is the use of one or several passwords to set the rights of the different types of users.
Encryption in the PDF specification
PDF uses RC4 and AES encryption algorithms.
The RC4 has symmetric stream encryption (i.e. the same algorithm can be used to encrypt and decrypt). But due to multiple vulnerabilities, it has become less secure and has become obsolete in PDF 2.0 (the latest PDF version). RC4 is trademarked.
It has been replaced by AES, an advanced encryption standard, much more complex and secure than RC4. It is also publicly available, on the contrary to RC4.
AES was adopted by the US government and is now used around the world. It is also a symmetric key algorithm, which means that the same key is used for both encrypting and decrypting data.
It is the only publicly available encryption approved by the NSA for top-secret information (for AES 192 and 256 specifically).
Advanced options
Most protect tools offer advanced permission features to manage sensitive files. This way, you can easily able or disable:
- printing,
- editing,
- copying of elements,
- access to text for screen readers intended visually impaired people.
Try our AvePDF Protect widget!
And when you need to unlock your file, we have a tool for that:
Try our AvePDF Unlock widget!
Remove sensitive information with PDF redaction
The permanent deletion of data from an electronic document is called PDF redaction.
It is an indispensable and necessary security tool for all businesses that use personal and/or sensitive data (i.e., all businesses).
Example of sensitive or personal data can be found in the text:
- social security numbers
- phone number and emails
- personal addresses
- name of people
- ID and passport numbers
And where you can find them in a PDF file, when they’re not in the visible text:
- pictures of people or places
- barcodes containing personal information
- metadata
- attachments
- annotations and comments
Indeed, a PDF file contains both visible information, which can be read, and hidden information such as metadata, attachments, bookmarks, and more, that you should delete if necessary.
To redact a PDF, we can use several techniques:
- redaction annotations (which are not simple annotations that hide the text or the image without destroying the underlying information – another time I will tell you about the most epic redaction fails, with major consequences…) for the visible text,
- and a process called sanitization to delete the hidden information.
We can remove information manually or automatically by associating tools such as OCR according to the context of use.
Try our AvePDF Redact PDF widget!
To wrap up
There are many other ways to secure PDF files and other electronic documents. You can, for instance, add a watermark (this tool is coming soon on AvePDF), remove text and images.
It all depends on your security strategy and what you want to do with your files!
Our free widgets show the most common security features, but our API can do much more behind the scenes!
Developers, check our desktop, Web, and Cloud APIs; you might want to use them in your applications!
Cheers!
Elodie
