GoKawiilMuPDF and Foxit found to generate weak AES-256 keys for encrypted PDFs
Researchers found that several PDF applications claiming AES-256 encryption actually derive their 32-byte file keys from a tiny or predictable pool of randomness. MuPDF, before version 1.28.5, seeded its random number generator with only the current time in seconds, leaving just 9 bits of effective entropy in the resulting key, while Foxit was found to base its key generation on time-based randomness with similar weaknesses.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the file key—not the user's password—actually encrypts a PDF's contents, a weak or guessable key lets an attacker decrypt a password-protected PDF without ever knowing the password. This suggests that documents encrypted with affected versions of these tools may have offered far less protection than their AES-256 labeling implied, particularly for files with recorded creation times.
- MuPDF before 1.28.5 generated AES-256 file keys from only about 9 bits of random state, making them enumerable.
- Foxit's key generation reportedly relied on time-based randomness, also making keys trivial to recover.
- The flaw undermines the password protection of PDFs encrypted with affected software, even though they advertised AES-256 security.
Source: v12.sh, 2026-10-28
Published there as: “The case of the 9 bit AES key”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.