HN

Need help?
<- Back
The case of the 9 bit AES key

The case of the 9 bit AES key

ledoge

Comments (50)

  • philsnow
    It's so insane to have PDF programs doing their own encryption, not because "don't roll your own crypto" (although yes for that reason too), but because the people who write PDF programs (libraries, viewers, general-purpose tools like qpdf, etc etc) aren't (necessarily) going to be great at understanding or designing good encryption UX.Also, I get that a lot of sensitive information is exchanged with PDFs these days, but why should PDFs have encryption built-in to the file format? Sensitive information is also exchanged in image files, word documents, zip files, html, etc etc etc etc. If you take all the work that goes into making the crypto UX decent for one kind of file and apply that to "all files", then each ecosystem doesn't have to invent their own.This is just like "high-end" car manufacturers insisting on making their own software, and not integrating apple carplay. They're either going to make a truly shitty podcast app, or they're not even going to bother and instead tell people to use bluetooth to listen to podcasts like it's 2006.
  • tptacek
    "MuPDF versions before 1.28.5 use an implementation of the drand48 family" yeah, ok, so they're basically not doing real encryption. The number of bits in the key space isn't the real story; the keys simply aren't cryptographically random.
  • NelsonMinar
    What is wrong with software engineers that we keep making really stupid basic mistakes like this? Sometimes I think programming should require licensing and regular testing.
  • jburgess777
    Does the DMCA still make it illegal to access encrypted content no matter how easy it is to discover the key? https://www.law.cornell.edu/uscode/text/17/1201Would the new LLM model owners like to strike this down, or use it to demonstrate how dangerous unrestricted models can be?
  • ubutler
    Rule #1 of rolling your own RNG: don’t.Rule #2? Please don’t.
  • snvzz
    That's way too many PDF implementations affected by this category of stupidity.It makes me wonder: Coincidence, really? There's enough there to think that there might be some invisible hand behind it.
  • JonChesterfield
    Wonderful.
  • paulpauper
    it's like the weak hardware wallet entropy bug
  • RobotToaster
    Obligatory xkcd https://m.xkcd.com/221/
  • esafak
    I assume this is the fruit of AI-driven decompilation? Nice work.
  • jeffbee
    You'd have to be completely off your rocker to use a PDF tool written in C anyway.