How PDF encryption works in PL/PDF

1. Initialize the document. Start the normal PL/PDF generation workflow.
2. Select AES-256. Choose the AES-256 algorithm through the PL/PDF security package.
3. Set passwords and permissions. Configure user and owner passwords together with the required PDF permission flags.
4. Generate the document. Create text, images, tables, forms and other PDF content through the normal PL/PDF APIs.
5. Encrypt the final PDF objects. PL/PDF applies the AES-256 security configuration while writing the document’s protected content.
6. Return the encrypted PDF. The final protected file is returned as an Oracle BLOB for delivery, storage or further processing.

AES-256 encryption in PL/SQL

Select AES-256 before configuring document protection. The existing PLPDF.setProtection API then controls the passwords and PDF permission flags.

declare
  l_pdf blob;
begin
  plpdf.init;

  plpdf_security.select_algorithm(
    plpdf_security.c_algorithm_aes_256
  );

  plpdf.setProtection(
    p_print_perm       => true,
    p_modify_perm      => false,
    p_copy_perm        => false,
    p_annot_forms_perm => false,
    p_user_pass        => 'customer-password',
    p_owner_pass       => 'document-owner-password'
  );

  plpdf.NewPage;
  plpdf.Text(
    20,
    30,
    'Protected customer statement'
  );

  plpdf.SendDoc(l_pdf);
end;
/

In this example the PDF can be opened with the user password, printing is permitted, and the modification, copying and annotation/form permission flags are disabled.

Use the right security layer for the job

AES-256 PDF encryption is useful when the PDF file itself must remain protected outside the database. It complements—rather than replaces—Oracle database security, application authorization, secure transport and organisational access controls.

• Use database and application authorization to control who can generate or obtain the document.
• Use TLS or another secure delivery channel when transmitting sensitive files.
• Use AES-256 PDF encryption when the exported PDF also requires file-level confidentiality.
• Use digital signatures when recipients need to verify document integrity or signer identity.