PDF 1.7 Extension 8 AES-256 — Hashcat Mode 10700

What's new in V=5/R=6

PDF 1.7 with Adobe Extension Level 8 (2010, alongside Acrobat X) added a new Standard Security Handler revision: V=5, R=6. The cipher is AES-256 in CBC mode. The key derivation moves from the legacy MD5-iterated chain to a SHA-256-based scheme with a per-attempt cost roughly two orders of magnitude higher than the old design.

Six new fields appear in the encryption dictionary: U (48 bytes), O (48 bytes), UE (32 bytes), OE (32 bytes), Perms (16 bytes), and the standard CF/CFM/AESV3 setup. The U and O fields contain validation salts plus the encrypted user and owner keys; UE and OE contain the encrypted file encryption key.

The two-stage design — the password verifies an intermediate key, and the intermediate key decrypts the actual file key — is similar to LUKS or BitLocker. It allows the password to change without re-encrypting the file content.

• V (algorithm version) = 5
• R (revision) = 6
• Length = 256 bits
• Cipher: AES-256 in CBC mode
• CFM = AESV3
• KDF: SHA-256 with multi-round mixing (variable cost)
• Two-key design: password → intermediate key → file key

Why mode 10700 is the strongest standard tier

Three things shape how mode 10700 compares with mode 10600. First, the cipher is identical: both use AES-256, whose 2^256 possible keys are far beyond exhaustive search and keep it firmly in the post-quantum-resistant category for current quantum computing. Nothing separates the two modes at the cipher level.

Second, the key derivation is far more expensive per attempt in mode 10700. Mode 10600 verifies a candidate with a single SHA-256 pass over the password and its salts and never iterates; mode 10700 runs Adobe's Algorithm 2.B, repeating a SHA-256 / SHA-384 / SHA-512 mixing step for at least 64 rounds. That reduces candidate throughput on the same hardware.

Third, the validation logic is more rigorous: the U field includes both a validation salt and a key salt, and verification must match a specific 32-byte hash output. False-positive verification through collisions on shorter hashes is impossible.

The SHA-256 hash chain

Adobe Algorithm 2.B describes the iterative hash. The first input is SHA-256(password || validation salt). Then up to 64 rounds of mixing follow: each round computes SHA-256, SHA-384 or SHA-512, chosen by the last byte of the previous output, with input being 64 copies of (password || previous || zero-padding). The variable-length input means GPU implementations cannot vectorise as efficiently as fixed-length hashes.

Adobe designed the algorithm to be expensive on purpose. Modern GPUs still attempt millions of candidates per second on a single high-end card, but that is two orders of magnitude slower than the equivalent throughput against mode 10500 or 10600. Attempts per second translate directly into recovery wall-clock time.

Identifying mode 10700 files

Look in the encryption dictionary for /V 5 /R 6 /Length 256 and the CFM=AESV3 entry. Adobe Reader X and later display 'AES-256 (Acrobat X+)' in the document properties security pane.

Files protected with the modern 'Acrobat X and later' option in any post-2010 Adobe product are mode 10700. Many enterprise PDF generation pipelines (Adobe Document Cloud, modern Foxit, modern Nitro) default to AES-256 today, so files created in 2018 or later are predominantly in this category.

The PDF version line at the top of the file (%PDF-1.7) is not a reliable indicator on its own — the same line could be V=4/R=4 (mode 10500), V=5/R=5 (mode 10600), or V=5/R=6 (mode 10700). Check the encryption dictionary directly.

Recovery realism for mode 10700

Mode 10700 recovery is most realistic when the password is short (under 8 characters), based on a common pattern (year plus word, name plus digit), or when the owner remembers significant fragments. Beyond that, recovery curves stretch into impractical timescales.

We do not quote a universal percentage because password type dominates the outcome. A random manager-generated password is usually outside a practical search; a remembered personal pattern may justify a free assessment.

Files in this tier are increasingly common in 2026 because Adobe products default to AES-256. If you have a recent document and remember roughly what you set, mode 10700 recovery is the right call. If you do not remember, the honest answer is that the file is likely permanent.

Quantum resistance considerations

AES-256 is widely considered quantum-resistant for confidentiality. Grover's algorithm gives only a quadratic speedup against symmetric ciphers, so AES-256 retains an effective 128-bit security margin against quantum adversaries — still beyond any feasible compute budget.

By contrast, the public-key components in PDF (digital signatures using RSA-2048 or ECDSA-P256) would be at risk under sufficiently large quantum computers. That risk applies to signatures, not to password-based content encryption.

For password recovery in 2026, quantum threats are not yet relevant. The bottleneck remains the password's own entropy, not the cipher.