CryptoAPI RC4 Encryption

CryptoAPI RC4 encryption is performed on portions of Office binary documents. The documents will contain a new stream (1) to contain encrypted information but can also encrypt other streams (1) in place. For more information about how to determine whether CryptoAPI RC4 encryption is being used and the placement of the password verifier, see [MS-XLS], [MS-DOC], and [MS-PPT]. The same mechanisms for generating the password verifier, storing data specifying the cryptography, deriving the encryption key, and encrypting data are used for all file formats supporting CryptoAPI RC4 encryption.