Open a password-protected PDF and the properties dialog will proudly tell you the document is secured with AES-256. That number describes the cipher. It says nothing about the key. This week, Rick de Jager at V12 published a disclosure showing what several PDF implementations actually do when they generate that key: MuPDF produced AES-256 file keys with only 9 bits of effective entropy, and Foxit derived its keys from the current timestamp. Both are recoverable without the password, in milliseconds, on a laptop.

The label was honest. The math was fine. The randomness was not.

How PDF encryption is supposed to work

When you encrypt a PDF with a password, the password does not encrypt the document directly. The software generates a random 32-byte file key, and that key encrypts the content with AES-256. Your password, salted and hashed, derives a second key whose only job is to encrypt the file key.…