● Covered by 1 source · 1 reportMedium impact1 negative
PDF Implementations Use Weak Randomness for AES-256 Keys, Allowing Decryption
Key points
- MuPDF versions before 1.28.5 use only 9 bits of random state for AES-256 keys.
- Foxit bases AES-256 keys on time-based randomness, making them recoverable.
- Weak randomness allows passwordless decryption of protected PDFs.
- The issue affects the 32-byte file key that encrypts PDF content.
Vulnerability in PDF Encryption
Researchers identified a significant vulnerability in how several PDF implementations generate AES-256 file keys. This flaw allows for the recovery of these keys without a password, enabling unauthorized decryption of protected PDF documents. The problem lies in the use of weak random number generation, which creates a small enough state space for keys to be enumerated.
MuPDF's Limited Randomness
Specifically, MuPDF versions prior to 1.28.5 were found to use only 9 bits of random state to influence the actual AES-256 key. This limited randomness originates from its implementation of the drand48 family generator, which is seeded once with the current epoch in seconds. The way output bytes are derived from the generator's state means that only a small portion of the state affects the final key, making it predictable.
Foxit's Time-Based Keys
Other PDF editors, such as Foxit, also exhibit similar vulnerabilities. Foxit's AES-256 key generation relies on time-based randomness. This method is inherently weak as time-based seeds are often predictable, leading to keys that are trivial to recover through brute-force or enumeration attacks.
Impact on PDF Security
PDF encryption is designed to protect document content, including metadata, by using a random 32-byte file key. This file key is then encrypted by a password-derived key. The discovered weaknesses in random number generation compromise the initial file key, effectively bypassing the password protection mechanism and allowing unauthorized access to document contents. This undermines the security assurances provided by AES-256 encryption in these affected PDF implementations.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Researchers discovered that several PDF implementations, including MuPDF and Foxit, generate AES-256 file keys using insufficient random states, making them vulnerable to enumeration and recovery. This flaw allows for passwordless decryption of protected PDF documents, undermining their security. The issue stems from poor random number generation practices, such as using time-based seeds or limited random state bits.