MuPDF's AES-256 key had only 9 bits of real randomness
The case of the 9 bit AES key
Several PDF tools generate their AES-256 file keys from tiny, enumerable state spaces. MuPDF before 1.28.5 seeded a 48-bit LCG with the current time in seconds, and only 9 bits of that timestamp ever reached the key, so all 512 possible streams can be brute-forced in about 11 milliseconds. Foxit hashes the timestamp plus 32 zero-filled bytes, letting a Rust tool test 370 million timestamps per second. OpenPDF and iText seed an ARC4 stream with time and free memory. MuPDF has fixed the flaw.
Timestamps that differ by 512 seconds produce exactly the same byte stream.
- tptacek
"MuPDF versions before 1.28.5 use an implementation of the drand48 family" yeah, ok, so they're basically not doing real encryption. The number of bits in the key space isn't the real story; the keys simply aren't cryptographically random.
- jburgess777
Does the DMCA still make it illegal to access encrypted content no matter how easy it is to discover the key? https://www.law.cornell.edu/uscode/text/17/1201
Would the new LLM model owners like to strike this down, or use it to demonstrate how dangerous unrestricted models can be?
- NelsonMinar
What is wrong with software engineers that we keep making really stupid basic mistakes like this? Sometimes I think programming should require licensing and regular testing.
- ubutler
Rule #1 of rolling your own RNG: don’t.
Rule #2? Please don’t.
- JonChesterfield
Wonderful.