| ▲ | The case of the 9 bit AES key(v12.sh) |
| 42 points by ledoge 2 hours ago | 14 comments |
| |
|
| ▲ | tptacek 5 minutes ago | parent | next [-] |
| "MuPDF versions before 1.28.5 use an implementation of the drand48 family" yeah, ok, so they're basically not doing real encryption. The number of bits in the key space isn't the real story; the keys simply aren't cryptographically random. |
|
| ▲ | ubutler 16 minutes ago | parent | prev | next [-] |
| Rule #1 of rolling your own RNG: don’t. Rule #2? Please don’t. |
| |
|
| ▲ | JonChesterfield 31 minutes ago | parent | prev | next [-] |
| Wonderful. |
|
| ▲ | paulpauper 2 hours ago | parent | prev | next [-] |
| it's like the weak hardware wallet entropy bug |
|
| ▲ | jeffbee an hour ago | parent | prev [-] |
| You'd have to be completely off your rocker to use a PDF tool written in C anyway. |
| |
| ▲ | advisedwang 34 minutes ago | parent | next [-] | | very VERY few people judge tools like this by the language used to develop them. | | |
| ▲ | j16sdiz a minute ago | parent | next [-] | | just down vote it. You can downvote anything not interesting. If he have list some alternative or give example, it might be interesting. | |
| ▲ | jeffbee 25 minutes ago | parent | prev [-] | | How many people judge their tools based on the AES key entropy? | | |
| ▲ | OptionX 10 minutes ago | parent [-] | | A lot actually. You're confusing just assuming by default its enough for purpose rather than not caring at all. |
|
| |
| ▲ | cowlevel 42 minutes ago | parent | prev | next [-] | | What are the alternatives? | |
| ▲ | lirolero an hour ago | parent | prev [-] | | Genuine question, since I'm not very knowledgeable about this: why is using C for a PDF tool such a bad idea? | | |
| ▲ | tptacek 4 minutes ago | parent | next [-] | | I think the claim is hyperbolic, since most people memory-unsafe PDF implementations, but PDF is a monster format, a metaformat that brings in virtually every conceivable display format, and their renderer implementations with them, often poorly-maintained, never-touched reference implementations from the before times. PDF is pretty scary. | |
| ▲ | recursive 5 minutes ago | parent | prev [-] | | buffer overflow vulnerability in code dealing with user generated data and a complex file format. |
|
|
