The case of the 9 bit AES key

(v12.sh)

43 points | by ledoge 1 hour ago

5 comments

  • tptacek 5 minutes ago
    "MuPDF versions before 1.28.5 use an implementation of the drand48 family" yeah, ok, so they're basically not doing real encryption. The number of bits in the key space isn't the real story; the keys simply aren't cryptographically random.
  • ubutler 16 minutes ago
    Rule #1 of rolling your own RNG: don’t.

    Rule #2? Please don’t.

    • j16sdiz 4 minutes ago
      That's why we use the system RNG !
  • JonChesterfield 31 minutes ago
    Wonderful.
  • paulpauper 1 hour ago
    it's like the weak hardware wallet entropy bug
  • jeffbee 57 minutes ago
    You'd have to be completely off your rocker to use a PDF tool written in C anyway.
    • advisedwang 34 minutes ago
      very VERY few people judge tools like this by the language used to develop them.
      • j16sdiz 1 minute ago
        just down vote it.

        You can downvote anything not interesting.

        If he have list some alternative or give example, it might be interesting.

      • jeffbee 25 minutes ago
        How many people judge their tools based on the AES key entropy?
        • OptionX 10 minutes ago
          A lot actually.

          You're confusing just assuming by default its enough for purpose rather than not caring at all.

    • cowlevel 42 minutes ago
      What are the alternatives?
    • lirolero 48 minutes ago
      Genuine question, since I'm not very knowledgeable about this: why is using C for a PDF tool such a bad idea?
      • tptacek 4 minutes ago
        I think the claim is hyperbolic, since most people memory-unsafe PDF implementations, but PDF is a monster format, a metaformat that brings in virtually every conceivable display format, and their renderer implementations with them, often poorly-maintained, never-touched reference implementations from the before times. PDF is pretty scary.
      • recursive 5 minutes ago
        buffer overflow vulnerability in code dealing with user generated data and a complex file format.