SEC: Warn about PDF encryption security

docs/user/encryption-decryption.md

@@ -5,6 +5,11 @@
 
 ## Encrypt
 
+> ⚠️ WARNING ⚠️: pypdf only implements [RC4 encryption](https://en.wikipedia.org/wiki/RC4).
+> This encryption algorithm is insecure. The more modern and secure AES
+> encryption is not implemented. pypdf can only decrypt, but not encrypt with
+> AES.
+
 Add a password to a PDF (encrypt it):
 
 ```python

pypdf/_writer.py

@@ -1027,6 +1027,12 @@ def encrypt(
                 5 and 6 control annotations, 9 for form fields,
                 10 for extraction of text and graphics.
         """
+        warnings.warn(
+            "pypdf only implements RC4 encryption so far. "
+            "The RC4 algorithm is insecure. Either use a library that supports "
+            "AES for encryption or put the PDF in an encrypted container, "
+            "for example an encrypted ZIP file."
+        )
         if user_pwd is not None:
             if user_password is not None:
                 raise ValueError(

tests/test_workflows.py

@@ -62,7 +62,8 @@ def test_basic_features(tmp_path):
 
     # encrypt your new PDF and add a password
     password = "secret"
-    writer.encrypt(password)
+    with pytest.warns(UserWarning, match="pypdf only implements RC4 encryption"):
+        writer.encrypt(password)
 
     # finally, write "output" to pypdf-output.pdf
     write_path = tmp_path / "pypdf-output.pdf"

tests/test_writer.py

@@ -479,11 +479,12 @@ def test_encrypt(use_128bit, user_password, owner_password, pdf_file_path):
     orig_text = page.extract_text()
 
     writer.add_page(page)
-    writer.encrypt(
-        user_password=user_password,
-        owner_password=owner_password,
-        use_128bit=use_128bit,
-    )
+    with pytest.warns(UserWarning, match="pypdf only implements RC4 encryption"):
+        writer.encrypt(
+            user_password=user_password,
+            owner_password=owner_password,
+            use_128bit=use_128bit,
+        )
 
     # write "output" to pypdf-output.pdf
     with open(pdf_file_path, "wb") as output_stream: