AES-256 PDF Encryption Undermined by Weak Key Generation

Multiple PDF readers including MuPDF, Foxit, OpenPDF, and iText advertise AES-256 encryption but generate file keys from predictable time-based sources instead of cryptographic randomness. MuPDF (before version 1.28.5) seeds its generator with the current time in seconds, but the low-level implementation means only 9 bits of the timestamp actually affect the generated key bytes—leaving just 512 possible keys. A brute-force attack takes approximately 11 milliseconds. Foxit derives keys from raw timestamps plus uninitialized memory, while OpenPDF and iText use millisecond-precision time plus JVM memory state, all equally inadequate for cryptographic security.

PDF encryption requires a randomly generated 32-byte file key to encrypt document content, then encrypts this file key with a password-derived key. When implementations use predictable sources for the file key, the entire security model breaks down. The flawed pattern originated in Foxit’s code and spread through PDFium into other tools. Vendors have been notified, and MuPDF released a fix, but previously encrypted documents remain permanently vulnerable.