The case of the 9 bit AES key

A recent investigation revealed that several PDF implementations generate their AES-256 file keys from state spaces too small to be secure. MuPDF, Foxit, and other PDF editors based their AES-256 keys on time-based randomness, making them easily recoverable. PDF encryption protects document strings and datastreams, including metadata, unless explicitly left unencrypted.

The password protection mechanism has evolved from RC4 to AES and improved password hashing against brute force attacks. Currently, revision 6 uses AES-256, where a password and a salt hash a separate key to encrypt the random 32-byte file key.

Due to inadequate randomness generation, MuPDF versions before 1.28.5 had a predictable AES-256 key, allowing passwordless decryption of protected PDFs. Foxit PDF Reader 2026.1.3.36551 generated the file key from a hash of the current timestamp, uninitialized bytes, and a constant, also resulting in weak keys. OpenPDF 3.0.5 and iText 9.7.1 suffered from similar issues, using an ARC4 stream seeded with a millisecond timestamp and the JVM's free memory for cryptographic randomness.

The investigation found that the promise of 256-bit security was undermined by insecure randomness sources and lower-than-advertised state space. While previously disclosed to the vendors, these bugs may still impact past published PDFs. Decryptors were published for MuPDF and Foxit to address the vulnerabilities.