I'm confused about how WanaCrypt's hybrid encryption scheme works after watching Computerphile's "How WanaCrypt Encrypt's Your Files" video a number times. Below is my thought process to make it easier to pinpoint my misunderstanding.

1. A public and private key pair is generated for the client, Cpub and Cpriv. These are generated whenever the malware is installed on someone's machine and is unique to the infected to ensure that the ransom be paid in each instance.
2. In the ransomware's executable is a server's public key, which has a private key, but is kept secret in an off-site location. I'll refer to these as Spub and Spriv.
3. Cpriv is encrypted with Spub. Cpriv cannot be decrypted without Spriv.
4. An AES symmetric key, Kf, is used to rapidly encrypt a machine's files.
5. Kf is then encrypted with Cpub.
6. In order to get to Kf, we need Cpriv, but we can't get to Cpriv because it has been encrypted with Spub. To get to Cpriv, we need Spriv.

The chain of encryption:

1. Encrypt files with Kf
2. Encrypt Kf with Cpub
3. Encrypt Cpriv with Spub

The chain of decryption:

1. Pay the ransom (but don't IRL)
2. The server gives the client Spriv
3. Spriv decrypts Spub, giving the client Cpriv
4. Cpriv decrypts Cpub, giving the client Kf
5. Kf, a symmetric key, is used to decrypt the files

All keys with the exception of Spriv are on the client's machine, but are encrypted. Buying Spriv starts a decryption chain giving access to one's files again.

Is my understanding of WanaCrypt's encryption method correct? Are there any important steps or pieces of information that I'm missing here?

I'm confused about how WannaCrypt's hybrid encryption scheme works after watching Computerphile's "How WannaCrypt Encrypt's Your Files" video a number times. Below is my thought process to make it easier to pinpoint my misunderstanding.

1. A public and private key pair is generated for the client, Cpub and Cpriv. These are generated whenever the malware is installed on someone's machine and is unique to the infected to ensure that the ransom be paid in each instance.
2. In the ransomware's executable is a server's public key, which has a private key, but is kept secret in an off-site location. I'll refer to these as Spub and Spriv.
3. Cpriv is encrypted with Spub. Cpriv cannot be decrypted without Spriv.
4. An AES symmetric key, Kf, is used to rapidly encrypt a machine's files.
5. Kf is then encrypted with Cpub.
6. In order to get to Kf, we need Cpriv, but we can't get to Cpriv because it has been encrypted with Spub. To get to Cpriv, we need Spriv.

The chain of encryption:

1. Encrypt files with Kf
2. Encrypt Kf with Cpub
3. Encrypt Cpriv with Spub

The chain of decryption:

1. Pay the ransom (but don't IRL)
2. The server gives the client Spriv
3. Spriv decrypts Spub, giving the client Cpriv
4. Cpriv decrypts Cpub, giving the client Kf
5. Kf, a symmetric key, is used to decrypt the files

All keys with the exception of Spriv are on the client's machine, but are encrypted. Buying Spriv starts a decryption chain giving access to one's files again.

Is my understanding of WannaCrypt's encryption method correct? Are there any important steps or pieces of information that I'm missing here?