How to add a secure and hidden attachment to a PDF document using iTextSharp

Question

I want to attach a file to an existing PDF document using iTextSharp and I can able to do it using pdfStamper.AddFileAttachment(...) method. Now I want to make the attachment hidden/secure in a way that no one able to see the attachment and even not able to retrieve it directly from PDF. It should only be retrieved from code.

Answer 1

I wouldn't store anything that has to be hidden in a File Attachment. That's a public, well-known mechanism that is understood and supported by multiple pieces of software (through UI).

If it has to be hidden and secure, I would protect the file by encrypting it in some way and then store all of it in a private CosStream somewhere in the document. The best way to do this would likely be the "Page-Piece Dictionaries" which provide a way to store product private data inside a PDF file. Private data can be attached to forms, pages or the document as a whole.

In my version of the PDF specification, this is paragraph 14.5, Page-Piece Dictionaries.

To include the concern of the OP and mkl's subsequent comment, there is no set expectation that Page-Piece data is encoded in any set way. The Page-Piece Dictionary contains a "Private" key that can have anything as value (so the value can be a string for smaller data, could be a dictionary containing multiple pieces of private information, or could be a stream that is compressed to keep it small).

From the PDF specification: "Private (key) : (Optional) Any private data appropriate to the conforming product, typically in the form of a dictionary". Remark the "typically" in the description. Further explanation in the PDF specification clarifies that the type of data stored may be anything you want.