Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

One of our users seems to have been hit by CryptoLocker. As a result, he has a hard drive full of encrypted files. The ransom-ware claims to have used public key encryption on the files.

If we know exact contents of some of the files prior to them being encrypted, would it be feasible to use those files to discover the private key?

share|improve this question
    
No, if they implemented asymmetric encryption properly, such attacks are not possible. –  CodesInChaos Oct 24 '13 at 16:57
    
Read up on known plaintext attacks. If the files have been encrypted with a modern symmetric cipher (likely) such as AES, you're out of luck. –  hunter Oct 24 '13 at 17:48
add comment

2 Answers

up vote 6 down vote accepted

If CryptoLocker does its job properly, then no, knowing part of the cleartext will not help you recover the rest. If that helped, then the encryption system would be called weak against known-plaintext attacks. From what I read, it seems that the CryptoLocker authors were competent(*), so no such luck.

(In particular, the asymmetric encryption with RSA-2048 is done only for a random symmetric key, and the bulk of the data is encrypted with a symmetric encryption algorithm like AES, using that key. This is the normal setup of hybrid encryption. This means that if you were to find weaknesses with regards to known plaintext, then you would have to look for them in the symmetric encryption algorithm, not the RSA part. The result, though, is the same: no known way to recover your data. Sorry.)

(*) I am here talking about the encryption. I believe the payment system may leave exploitable traces which would allow law enforcement agencies to track down the perpetrators. But this is likely to involve countries of questionable cooperativeness, so don't put too much hope in this.

share|improve this answer
add comment

One chance. If they screwed up and used the same symmetric key for encrypting all files, you might, depending on the cypher they used, be able to read all files up to the length of the data you have. Otherwise, you're out of luck.

share|improve this answer
2  
The malware seems to do its cryptography by the book, so there is no way to recover your scrambled files once it has triggered. according to the link provided –  rath Oct 24 '13 at 23:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.