I've read various articles about Microsoft's Office 2007 encryption and from what I gather 2007 is secure using all default options due to it using AES, and 2000 and 2003 can be configured secure by changing the default algorithm to AES. I was wondering if anyone else has read any other articles or know of any specific vulnerabilities involved with how they implement the encryption. I would like to be able to tell users that they can use this to send semi-sensitive documents as long as they use AES and a strong password. Thanks for the information.
Yes office encryption is pretty secure. I put together a presentation on office 2007 security a while back. Here are the relevent bits from a whitepaper I referenced.
See also Dave Leblanc's blog
Office 2007 Encyption is good, but only when these two things apply:
If the file you open is in Compatibility Mode you can't guarantee the security of the file (It could be in Office 97 Compatibility mode, where encryption can be broke in <10 seconds).
Office 2003 Encryption can be good. In Office 2003 the Encryption is set by default to be compatible with Office 97 (<10 second problem). It can be set to use RC4 which is somewhat secure. It uses 40 to 128-bit keys. RC4 has come under scrutiny of late though with the way it works; and many theorize a brute force attack would take significatly less time than 2^n.