Encrypted File Wrappers
***********************

SPSS 21 and later can package multiple kinds of files inside an encrypted wrapper.  The wrapper has a common format, regardless of the kind of the file that it contains.

     The SPSS encryption wrapper is poorly designed.  It is much cheaper and faster to decrypt a file encrypted this way than if a well designed alternative were used.  If you must use this format, use a 10-byte randomly generated password.

Common Wrapper Format
=====================

This section describes the general format of an SPSS encrypted file wrapper.  The following sections describe the details for each kind of encapsulated file.

An encrypted file wrapper begins with the following 36-byte header, where xxx identifies the type of file encapsulated, as described in the following sections:

     0000  1c 00 00 00 00 00 00 00  45 4e 43 52 59 50 54 45  |........ENCRYPTE|
     0010  44 xx xx xx 15 00 00 00  00 00 00 00 00 00 00 00  |Dxxx............|
     0020  00 00 00 00                                       |....|

Following the fixed header is essentially the regular contents of the encapsulated file in its usual format, with each 16-byte block encrypted with AES-256 in ECB mode.  Each type of encapsulated file is processed in a slightly different way before encryption, as described in the following sections.  The AES-256 key is derived from a password in the following way:

 1. Start from the literal password typed by the user.  Truncate it to at most 10 bytes, then append as many null bytes as necessary until there are exactly 32 bytes.  Call this PASSWORD.

 2. Let CONSTANT be the following 73-byte constant:

          0000  00 00 00 01 35 27 13 cc  53 a7 78 89 87 53 22 11
          0010  d6 5b 31 58 dc fe 2e 7e  94 da 2f 00 cc 15 71 80
          0020  0a 6c 63 53 00 38 c3 38  ac 22 f3 63 62 0e ce 85
          0030  3f b8 07 4c 4e 2b 77 c7  21 f5 1a 80 1d 67 fb e1
          0040  e1 83 07 d8 0d 00 00 01  00

 3. Compute CMAC-AES-256(PASSWORD, CONSTANT).  Call the 16-byte result CMAC.

 4. The 32-byte AES-256 key is CMAC || CMAC, that is, CMAC repeated twice.

Example
-------

Consider the password pspp.  PASSWORD is:

     0000  70 73 70 70 00 00 00 00  00 00 00 00 00 00 00 00  |pspp............|
     0010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

CMAC is:

     0000  3e da 09 8e 66 04 d4 fd  f9 63 0c 2c a8 6f b0 45

The AES-256 key is:

     0000  3e da 09 8e 66 04 d4 fd  f9 63 0c 2c a8 6f b0 45
     0010  3e da 09 8e 66 04 d4 fd  f9 63 0c 2c a8 6f b0 45

Encrypted System Files
----------------------

An encrypted system file uses SAV as the identifier in its header.

Before encryption, a system file is appended with as many null bytes as needed (possibly zero) to make it a multiple of 16 bytes in length, so that it fits exactly in a series of AES blocks.  (This implies that encrypted system files must always be compressed, because otherwise a system file with only a single variable might appear to have an extra case.)

Encrypted Syntax Files
----------------------

An encrypted syntax file uses SPS as the identifier in its header.

Before encryption, a syntax file is prefixed with a line at the beginning of the form * Encoding: ENCODING., where ENCODING is the encoding used for the rest of the file, e.g. windows-1252.  The syntax file is then appended with as many bytes with value 04 as needed (possibly zero) to make it a multiple of 16 bytes in length.

Password Encoding
=================

SPSS also supports what it calls ``encrypted passwords.''  These are not encrypted.  They are encoded with a simple, fixed scheme.  An encoded password is always a multiple of 2 characters long, and never longer than 20 characters.  The characters in an encoded password are always in the graphic ASCII range 33 through 126.  Each successive pair of characters in the password encodes a single byte in the plaintext password.

Use the following algorithm to decode a pair of characters:

 1. Let A be the ASCII code of the first character, and B be the ASCII code of the second character.

 2. Let AH be the most significant 4 bits of A.  Find the line in the table below that has AH on the left side.  The right side of the line is a set of possible values for the most significant 4 bits of the decoded byte.

          2  => 2367
          3  => 0145
          47 => 89cd
          56 => abef

 3. Let BH be the most significant 4 bits of B.  Find the line in the second table below that has BH on the left side.  The right side of the line is a set of possible values for the most significant 4 bits of the decoded byte.  Together with the results of the previous step, only a single possibility is left.

          2  => 139b
          3  => 028a
          47 => 46ce
          56 => 57df

 4. Let AL be the least significant 4 bits of A.  Find the line in the table below that has AL on the left side.  The right side of the line is a set of possible values for the least significant 4 bits of the decoded byte.

          03cf => 0145
          12de => 2367
          478b => 89cd
          569a => abef

 5. Let BL be the least significant 4 bits of B.  Find the line in the table below that has BL on the left side.  The right side of the line is a set of possible values for the least significant 4 bits of the decoded byte.  Together with the results of the previous step, only a single possibility is left.

          03cf => 028a
          12de => 139b
          478b => 46ce
          569a => 57df

Example
-------

Consider the encoded character pair -|.  A is 0x2d and B is 0x7c, so AH is 2, BH is 7, AL is 0xd, and BL is 0xc.  AH means that the most significant four bits of the decoded character is 2, 3, 6, or 7, and BH means that they are 4, 6, 0xc, or 0xe.  The single possibility in common is 6, so the most significant four bits are 6.  Similarly, AL means that the least significant four bits are 2, 3, 6, or 7, and BL means they are 0, 2, 8, or 0xa, so the least significant four bits are 2.  The decoded character is therefore 0x62, the letter b.