I'm the maintainer of pypdf, a Python library for reading/manipulating PDF documents. I recently discovered that pypdf used
random instead of
secrets for ...
- Generating the initialization vector (IV) in AES
- As part of generating the U-Value (PDF specs: "Password Algorithms", the "user password" )
- As part of generating the O-Value (PDF specs: "Password Algorithms", the "owner password" )
- As part of the data of AES_ECB_encrypt
I'm now thinking about issuing a security notice, besides the entry in the changelog.
To clarify: this question is about (1). Hence the question: Would an attack on a document encrypted with an initialization vector generated via Pythons
random module become feasible?