I'll try and do some tests tomorrow, but I have some remarks:
...it is not possible to have the worksheet protection empty for an unprotected sheet...
<sheetProtection password="CF7A" sheet="1" selectLockedCells="1"/>
The attribute sheet under sheetProtection is the one controlling if the worksheet is protected or not. if sheet="0",, it will ignore all other protection.
I think this is a very Excel-specific way to do it. I think that the elements of the sheet Protection set should behave like those of the cell protection: they need another "event" to become active - in case of the cell protection the sheet protection must be activated before the cell protection items become active. And in case of the sheet protection? The event to activate this in Excel's implementation is an element of the set itself. This concept is very confusing, and it took me a long time to understand what spSheet really means, and maybe some of the words in my previous post are wrong for this reason. In my implementation sheet protection is activated by adding soProtected to the all-purpose Options of the worksheet. I left spSheet in the set, but renamed it to spCells because I think there might be concepts in which all cells can be allowed for editing but anything else is frozen. (Probably "spEdit" would be a better word?). Next, I'll look at how LibreOffice handles security. If they do it like Excel, I'll probably remove spCells altogether.
I intentionally add the password field so to make distinguishing between old and new hashing bit easier; maybe removing it and assigning AlgorithmName:=EXCELOLDHASH will make more sense
[...]
This is the code for generating Excel 2010 and earlier password's hash
Thanks for posting the Excel hashing algorithm.
Since also the old Excel versions have the encrypted password in the file I would prefer to write it to the field "Hashvalue" of the TsCryptoInfo, yes, with EXCELHASH (or similar) in the AlgorithmName field. Maybe a better word for "HashValue" would be "PasswordHash"
Never happened to me under Excel 2010 (I assume it's the same with 2007),, only when Encrypting the document the files loses its signature; I usually protect the workbook from the Review tab.
My Excel experience with protection and encryption is very limited. Here's what I do: I open Excel 2007, it comes up with an empty worksheet. I go to "Review", select "Protect workbook" and enter a password ("test") in the edit box (leave the two checkboxes alone). I confirm the password in the next dialog, and then I save as xlsx. I open the file in a hex editor. The first two bytes in the file are $D0 $CF which is not the signature of a zip file which would be $50 $4B ('PK'). Therefore, fpspreadsheet cannot read the file. Even if we had an implementation of decryption it would not be possible to read the workbook cryptoinfo field for the algorithm to be applied for decryption. Really bad implementation by MS unless they assume that the file is always encrypted using their own algorithm...
Is there an Excel setting somewhere which automaticlly causes file encryption when workbook protection w/ password is activated?