diff --git a/src/UglyToad.PdfPig/Encryption/EncryptionHandler.cs b/src/UglyToad.PdfPig/Encryption/EncryptionHandler.cs
index da39699e..ee49ab46 100644
--- a/src/UglyToad.PdfPig/Encryption/EncryptionHandler.cs
+++ b/src/UglyToad.PdfPig/Encryption/EncryptionHandler.cs
@@ -358,6 +358,16 @@
 
                         break;
                     }
+                case HexToken hexToken:
+                {
+                    var data = hexToken.Bytes.ToArray();
+
+                    var decrypted = DecryptData(data, reference);
+
+                    token = new HexToken(Hex.GetString(decrypted).ToCharArray());
+
+                    break;
+                }
                 case DictionaryToken dictionary:
                     {
                         // PDFBOX-2936: avoid orphan /CF dictionaries found in US govt "I-" files
diff --git a/src/UglyToad.PdfPig/Fonts/Parser/Parts/CidFontFactory.cs b/src/UglyToad.PdfPig/Fonts/Parser/Parts/CidFontFactory.cs
index ed377446..1dd138a3 100644
--- a/src/UglyToad.PdfPig/Fonts/Parser/Parts/CidFontFactory.cs
+++ b/src/UglyToad.PdfPig/Fonts/Parser/Parts/CidFontFactory.cs
@@ -322,7 +322,17 @@
 
             if (token is IndirectReferenceToken obj)
             {
-                return DirectObjectFinder.Get<StringToken>(obj, pdfScanner).Data;
+                if (DirectObjectFinder.TryGet(obj, pdfScanner, out StringToken stringToken))
+                {
+                    return stringToken.Data;
+                }
+
+                if (DirectObjectFinder.TryGet(obj, pdfScanner, out HexToken hexToken))
+                {
+                    return hexToken.Data;
+                }
+
+                throw new PdfDocumentFormatException($"Could not get key for name: {keyName} in {dictionary}.");
             }
 
             return string.Empty;