Description

openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iterations for dual-encryption file-password verification. Attackers who obtain keyfiles or encrypted files can brute-force wrapping passwords offline using GPU or ASIC acceleration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:21:02.180Z",
  "pubdate": "2026-08-27T17:21:02.180Z",
  "executiveSummary": "The openssl_encrypt library, in versions prior to 1.4.9, exhibits a cryptographic weakness involving under-parameterized PBKDF2-HMAC-SHA256 implementations.\nThe vulnerability stems from the use of insufficient iteration counts for key derivation: 100,000 iterations for PQC keyfile private keys and 10,000 iterations for file-password verification.\nThis low computational cost allows attackers who have exfiltrated the encrypted keyfiles or target data to conduct highly efficient offline brute-force attacks.\nLeveraging GPU or ASIC acceleration, an adversary can rapidly iterate through password dictionaries to recover the wrapping keys, effectively bypassing the encryption layer.\nThe impact is a complete loss of confidentiality for the encrypted PQC keyfiles and associated dual-encryption files, facilitating unauthorized access to sensitive cryptographic material.\nExploitation requires no prior network privileges, only access to the encrypted data at rest; therefore, the risk is classified as critical due to the reduced entropy and brute-force resistance.",
  "technicalDetails": "The vulnerability resides in the key derivation function (KDF) implementation within openssl_encrypt prior to version 1.4.9. The library utilizes the PBKDF2-HMAC-SHA256 algorithm to derive wrapping keys from user-supplied passwords.\nRoot Cause: The root cause is the selection of sub-optimal iteration counts. Iteration counts act as a work factor designed to artificially increase the computational expense of hash calculations, thereby thwarting parallelized brute-force attacks. The current configuration of 100,000 iterations for PQC keyfiles and 10,000 for password verification falls significantly below modern security standards, which typically require iteration counts into the millions to remain resilient against specialized hardware.\nAttack Flow: An attacker begins by acquiring the encrypted file or PQC keyfile through common vectors such as unauthorized system access, data leakage, or interception. Once the artifact is obtained, the attacker extracts the salt and the derived hash (if applicable). Utilizing custom scripts or off-the-shelf password cracking tools, the attacker interfaces with hardware accelerators—specifically high-end GPUs or ASIC clusters—to perform massive parallel hashing operations.\nExploitation Method: Because PBKDF2-HMAC-SHA256 is computationally inexpensive per cycle, the 10,000 to 100,000 iterations allow for millions of password guesses per second. An attacker iterates through a target password candidate list against the known salt. If the resulting derived key successfully decrypts the keyfile or matches the verification token, the password is recovered. Once the wrapping key is cracked, the attacker proceeds to decrypt the PQC private keys or the secondary encryption layer.\nExposure: This is an offline attack, meaning the library does not need to be 'active' on a network; once the encrypted data is obtained, the vulnerability exists entirely within the static file structure. There are no authentication or privilege requirements for the attacker, as they are not interacting with the system's runtime environment but rather the encrypted data itself. The post-exploitation impact includes the full compromise of protected private keys, allowing the attacker to sign, decrypt, or otherwise manipulate data intended for protected PQC communications."
}