Change hash algorithm from MD5 to better SHA-512 for PdfEncryption and SmartModePdfObjectsSerializer

DEVSIX-7380

Author: introfog

kernel/src/main/java/com/itextpdf/kernel/pdf/PdfEncryption.java

@@ -23,7 +23,6 @@ This file is part of the iText (R) project.
 package com.itextpdf.kernel.pdf;
 
 import com.itextpdf.commons.utils.SystemUtil;
-import com.itextpdf.kernel.exceptions.PdfException;
 import com.itextpdf.kernel.crypto.IDecryptor;
 import com.itextpdf.kernel.crypto.OutputStreamEncryption;
 import com.itextpdf.kernel.crypto.securityhandler.PubKeySecurityHandler;
@@ -38,7 +37,9 @@ This file is part of the iText (R) project.
 import com.itextpdf.kernel.crypto.securityhandler.StandardHandlerUsingStandard40;
 import com.itextpdf.kernel.crypto.securityhandler.StandardSecurityHandler;
 import com.itextpdf.kernel.exceptions.KernelExceptionMessageConstant;
+import com.itextpdf.kernel.exceptions.PdfException;
 import com.itextpdf.kernel.security.IExternalDecryptionProcess;
+
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
@@ -255,17 +256,17 @@ public PdfEncryption(PdfDictionary pdfDict, Key certificateKey, Certificate cert
     }
 
     public static byte[] generateNewDocumentId() {
-        MessageDigest md5;
+        MessageDigest sha512;
         try {
-            md5 = MessageDigest.getInstance("MD5");
+            sha512 = MessageDigest.getInstance("SHA-512");
         } catch (Exception e) {
             throw new PdfException(KernelExceptionMessageConstant.PDF_ENCRYPTION, e);
         }
         long time = SystemUtil.getTimeBasedSeed();
         long mem = SystemUtil.getFreeMemory();
         String s = time + "+" + mem + "+" + (seq++);
 
-        return md5.digest(s.getBytes(StandardCharsets.ISO_8859_1));
+        return sha512.digest(s.getBytes(StandardCharsets.ISO_8859_1));
     }
 
     /**

kernel/src/main/java/com/itextpdf/kernel/pdf/SmartModePdfObjectsSerializer.java

@@ -26,17 +26,16 @@ This file is part of the iText (R) project.
 import com.itextpdf.kernel.exceptions.PdfException;
 
 import java.security.MessageDigest;
-
 import java.util.HashMap;
 import java.util.Map;
 
 class SmartModePdfObjectsSerializer {
-    private MessageDigest md5;
+    private MessageDigest sha512;
     private HashMap<SerializedObjectContent, PdfIndirectReference> serializedContentToObj = new HashMap<>();
 
     SmartModePdfObjectsSerializer() {
         try {
-            md5 = MessageDigest.getInstance("MD5");
+            sha512 = MessageDigest.getInstance("SHA-512");
         } catch (Exception e) {
             throw new PdfException(e);
         }
@@ -110,7 +109,7 @@ private void serObject(PdfObject obj, ByteBuffer bb, int level, Map<PdfIndirectR
             serDic((PdfDictionary) obj, bb, level - 1, serializedCache);
             bb.append("$B");
             if (level > 0) {
-                bb.append(md5.digest(((PdfStream) obj).getBytes(false)));
+                bb.append(sha512.digest(((PdfStream) obj).getBytes(false)));
             }
         } else if (obj.isDictionary()) {
             serDic((PdfDictionary) obj, bb, level - 1, serializedCache);