PDF 1.7 Level 3 AES-256 — Hashcat Mode 10600

What hashcat mode 10600 actually is

Mode 10600 is the hashcat mode for PDF 1.7 Adobe Extension Level 3 — the Standard Security Handler revision that shipped with Acrobat 9 in 2008. In the encrypt dictionary it appears as V=5, R=5, Length=256, with a crypt filter method of AESV3. A hash extracted from such a file carries the prefix `$pdf$5*5*256*`, which is the quickest way to confirm the mode from the hash string alone.

The V=5 handler has two revisions and hashcat keeps them apart: revision 5 is mode 10600, while revision 6 (Adobe Extension Level 8, Acrobat X, 2010) is mode 10700. The cipher is AES-256 in both cases. What differs — and what drives the recovery cost — is the key derivation, not the cipher.

It is worth stating plainly what mode 10600 is not. It is not AES-128. AES-128 files use V=4/R=4 and are submitted to hashcat as mode 10500, the same mode that covers 128-bit RC4, because the password check in that revision is the shared 50-iteration MD5 derivation.

• V (algorithm version) = 5
• R (revision) = 5
• Length = 256 bits
• Cipher: AES-256 in CBC mode
• CFM (crypt filter method) = AESV3
• Hash prefix: `$pdf$5*5*256*...`

Why the single SHA-256 derivation is the fast one

Revision 5 derives its key material in one pass. The password is hashed with SHA-256 together with the validation salt to check the candidate, and hashed again with the key salt to unwrap the file encryption key. Nothing multiplies that cost: there is no iteration count, and therefore no loop for a GPU to grind through on every guess.

That is the whole reason mode 10600 is the fastest of the AES tiers to search. Cost per candidate sits close to that of a plain hash rather than a hardened key-derivation function, so hardware that tests candidates quickly against revision 5 tests far fewer of them per second against revision 6, where Adobe's Algorithm 2.B repeats a SHA-256 / SHA-384 / SHA-512 mixing step for a minimum of 64 rounds.

Adobe's choice was short-lived for the same reason. Revision 5 existed only in the 2008-2010 window before revision 6 replaced it with the iterated design, so files in this mode cluster in that period.

Identifying a mode 10600 file

The encrypt dictionary is the authoritative source. Look for `/V 5 /R 5 /Length 256` together with `/CFM /AESV3` in the crypt filter sub-dictionary. Tools such as qpdf --show-encryption, pdfinfo, or the pikepdf library print the V, R, and Length values without requiring the password.

Acrobat 9 (2008-2010) is the release that produced these files, along with third-party libraries that implemented the V=5/R=5 handler during the same window. Adobe moved to revision 6 afterwards, so a document created after 2010 is usually mode 10700 rather than mode 10600.

Do not trust the PDF version line. `%PDF-1.7` appears on V=2/R=3, V=4/R=4, V=5/R=5, and V=5/R=6 documents alike; only the encrypt dictionary separates them.

• `/V 5`, `/R 5`, `/Length 256` in the encrypt dictionary
• `/CFM /AESV3` in the crypt filter
• R=5 is deprecated in PDF 2.0 and is not used for newly created documents
• `%PDF-1.7` on its own proves nothing about the security handler

What recovery actually depends on

AES-256 is not the constraint. There is no practical cryptographic shortcut against the full cipher, and its key space is far beyond exhaustive search, so recovery reduces to guessing the password through the same derivation Adobe Reader applies. The cipher is sound; the question is always the password.

What the cheap derivation changes is where the practical boundary sits. Because each candidate costs so little, human-shaped passwords — a word plus a year, a name plus digits, a short keyboard pattern, a reused work password — are found quickly, and bounded mask searches over short lengths are worth attempting. A genuinely random, high-entropy password stays out of reach no matter how inexpensive the per-candidate cost is.

Hints remain the single biggest controllable factor. A length range, the character classes used, a remembered fragment, the year the file was created: each one narrows the search. Without any hint, the work is a targeted dictionary and mask search against common patterns, and nothing more can honestly be promised.

The practical difference from mode 10700

Both modes protect a document with AES-256, and owners frequently cannot tell which one they have. The cost of confusing them is a badly misjudged timeline: revision 6 adds iteration to the derivation specifically to slow candidate testing down, so a password pattern that is comfortably feasible under mode 10600 can be out of range under mode 10700 on identical hardware.

The practical read: a file from the Acrobat 9 window whose password a human chose is the more favourable case. A file from Acrobat X or later — or from any modern tool that defaults to AES-256 — should be assumed to be revision 6 until the encrypt dictionary says otherwise.

Neither mode is broken. A strong random password defeats both, and a weak one is findable in both; only the cost per guess differs.

Where mode 10600 sits among the PDF modes

The standard PDF modes are distinguished by the encrypt dictionary rather than by the PDF version line. V=1/R=2 with a 40-bit key is mode 10400. V=2/R=3 with 128-bit RC4 and V=4/R=4 with AES-128 are both mode 10500. V=5/R=5 with AES-256 is mode 10600, and V=5/R=6 with AES-256 is mode 10700.

Mode 25400 is a separate case again: it covers PDF 1.4-1.6 (Acrobat 5-8) files where both the user and the owner password must be satisfied, and its example hash is the revision-3 128-bit format. It does not apply to the revision-5 files described on this page.

Classifying the file first is the highest-value step for an owner, because the mode determines which derivation is in play, and the derivation determines how expensive each guess is.

Frequently Asked Questions

Related references