Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of our users seems to have been hit by CryptoLocker. As a result, he has a hard drive full of encrypted files. The ransom-ware claims to have used public key encryption on the files.

If we know exact contents of some of the files prior to them being encrypted, would it be feasible to use those files to discover the private key?

share|improve this question
No, if they implemented asymmetric encryption properly, such attacks are not possible. – CodesInChaos Oct 24 '13 at 16:57
Read up on known plaintext attacks. If the files have been encrypted with a modern symmetric cipher (likely) such as AES, you're out of luck. – hunter Oct 24 '13 at 17:48
up vote 8 down vote accepted

If CryptoLocker does its job properly, then no, knowing part of the cleartext will not help you recover the rest. If that helped, then the encryption system would be called weak against known-plaintext attacks. From what I read, it seems that the CryptoLocker authors were competent(*), so no such luck.

(In particular, the asymmetric encryption with RSA-2048 is done only for a random symmetric key, and the bulk of the data is encrypted with a symmetric encryption algorithm like AES, using that key. This is the normal setup of hybrid encryption. This means that if you were to find weaknesses with regards to known plaintext, then you would have to look for them in the symmetric encryption algorithm, not the RSA part. The result, though, is the same: no known way to recover your data. Sorry.)

(*) I am here talking about the encryption. I believe the payment system may leave exploitable traces which would allow law enforcement agencies to track down the perpetrators. But this is likely to involve countries of questionable cooperativeness, so don't put too much hope in this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.