How a save encrypts the document for certificate recipients with the public-key security handler: who the recipients are, what each may do, and whether metadata is encrypted.
public sealed class PdfPublicKeyEncryptionOptions
ISO 32000-2 §7.6.5. The saved file names the handler Adobe.PubSec with SubFilter adbe.pkcs7.s5: V 5, and a
crypt filter DefaultCryptFilter (method AESV3, 256 bits) that StmF and StrF name, which holds the
Recipients (Table 27). Recipients with the same permissions share one CMS enveloped-data object (RFC 5652), in the order
they were first added; its content is a random 20-byte seed followed by their permissions (§7.6.5.3), and its content-encryption
key is encrypted for each of them with RSA (PKCS #1 v1.5) and named by issuer and serial number. The file encryption key is the
SHA-256 digest of the seed and every CMS object in order (and four 0xFF bytes when metadata is left in plaintext), and strings and
streams are encrypted with AES-256 (§7.6.3.3, Algorithm 1.A). AES-256 is a PDF 2.0 feature, so the header is raised to 2.0 (in
strict mode, a document below 2.0 refuses the save).
Opening the saved file with a recipient's certificate and private key (PdfCertificateCredentials) grants that recipient's permissions; a recipient added with AddOwner(X509Certificate2) has owner access. Every string and stream is encrypted except those §7.6.2 exempts, as with PdfEncryptionOptions. Certificates and CMS are not available in a browser (WebAssembly), where such a save throws PdfEncryptionNotSupportedException.
kind:method, kind:property, kind:ctor. Press Esc to clear.EncryptMetadataGets or sets a value indicating whether metadata streams are encrypted. The default is true; with false, a metadata stream stays readable to tools that index files without a certificate.IntegrityProtectionGets or sets a value indicating whether the saved file carries an integrity MAC (a PDF MAC token) that every later revision must carry as well. The default is false.RecipientsGets the recipients, in the order they were added.AddOwner(X509Certificate2)Adds a recipient who opens the document with owner access: every permission, including changing the encryption.AddRecipient(X509Certificate2, PdfPermissions)Adds a recipient who opens the document with permissions.