Can passwords in encrypted files be hacked?

[TaxDudle]

I have been told that the code for Adobe Acrobat has been stolen and the hackers have created an App that can crack the password on any password encrypted file created by Adobe Acrobat.  Has anyone heard of this or is this a hoax?

[Test Screen Name]

That's nonsense. The way passwords are done is described publicly - there is absolutely no code to steal.

Open passwords are vulnerable to "brute force" attacks like all other passwords in files.

[margueritek]

No need to hack the code, the password algorithms are part of the PDF standard, for all to see. Having said that: Acrobat 5 compatible passwords (40-bit RC4 encryption) can be bypassed because 40-bits is small enough to generate a table of all possible keys (called a Rainbow table). You can't crack the password, but you can crack the file. Acrobat 6 introduced 128-bit RC4 encryption. Acrobat 7 has 128-bit AES encryption. In both of these cases, Rainbow tables are not practical, but the password is limited to 32 characters, ASCII. Short, plain, passwords are hacked using a dictionary attack: a file of thousands of common  passwords is tried, followed by exhaustive search over all passwords. Up to about 6 or 8 characters, a password can be found in at most a couple of days. So if you use one of these encryption methods you should use long (12 or more characters) pass phrases (yes, spaces are allowed). Acrobat X takes it one step farther, using 256 bit keys and AES encryption, and allowing very long pass phrases (up to 127 characters) in any language. In addition, the Acrobat X password algorithm was deliberately designed to run slowly, so it takes a long time to do a brute-force search. You still want to stay away from dictionary attacks, though.