The case of the 9 bit AES key

The AES-256 file keys used in several PDF implementations are generated from a small state space, making them easily enumerable. MuPDF's implementation only uses 9 bits of random state to create the AES-256 key, while other PDF editors like Foxit base their keys on time-based randomness. PDF encryption protects document strings and datastreams, but it does not encrypt the entire document directly.

Instead, a random 32-byte file key encrypts the content, which is then encrypted with a key derived from the password and a salt.

The randomness used in generating these keys is often insecure, leading to easily recoverable passwords. MuPDF versions prior to 1.28.5 use an implementation of the drand48 family to generate random numbers. This generator is seeded using the current epoch in seconds and a linear congruential generator (LCG) that shifts bits and discards higher bits, leaving only 9 bits that affect the output. This limited state space allows brute-forcing all possible 32-byte keys, decrypting the document in approximately 11 milliseconds.

Foxit PDF Reader uses a different approach, deriving the file key as a hash of the current timestamp, 32 uninitialized bytes, and a constant. This method also fails to provide adequate randomness, undermining the security benefits of the AES-256 encryption. The vulnerabilities have been disclosed to the vendors, with MuPDF's issue resolved, but the consequences of these weak implementations persist.