Understanding WannaCrypt's hybrid encryption scheme

Question

I'm confused about how WannaCrypt's hybrid encryption scheme works after watching Computerphile's "How WannaCrypt Encrypt's Your Files" video a number times. Below is my thought process to make it easier to pinpoint my misunderstanding.

1. A public and private key pair is generated for the client, Cpub and Cpriv. These are generated whenever the malware is installed on someone's machine and is unique to the infected to ensure that the ransom be paid in each instance.
2. In the ransomware's executable is a server's public key, which has a private key, but is kept secret in an off-site location. I'll refer to these as Spub and Spriv.
3. Cpriv is encrypted with Spub. Cpriv cannot be decrypted without Spriv.
4. An AES symmetric key, Kf, is used to rapidly encrypt a machine's files.
5. Kf is then encrypted with Cpub.
6. In order to get to Kf, we need Cpriv, but we can't get to Cpriv because it has been encrypted with Spub. To get to Cpriv, we need Spriv.

The chain of encryption:

1. Encrypt files with Kf
2. Encrypt Kf with Cpub
3. Encrypt Cpriv with Spub

The chain of decryption:

1. Pay the ransom (but don't IRL)
2. The server gives the client Spriv
3. Spriv decrypts Spub, giving the client Cpriv
4. Cpriv decrypts Cpub, giving the client Kf
5. Kf, a symmetric key, is used to decrypt the files

All keys with the exception of Spriv are on the client's machine, but are encrypted. Buying Spriv starts a decryption chain giving access to one's files again.

Is my understanding of WannaCrypt's encryption method correct? Are there any important steps or pieces of information that I'm missing here?

Answer 1

The server will never release Spriv, it protects all ransomed clients. Assuming the server wants to allow a given client to decrypt it's file the server will use Spriv to decrypt Cpriv and send that to the client. With Cpriv only the paying client/victim can decrypt the various symmetric keys $K_f$ and use them to decrypt his files.

It is worth to discuss a simpler solution not mentioned in the video where all files have the same symmetric key (and different nonce/IV), and the symmetric key is encrypted directly with Spub. Such a setup will have the single client private key available on the client until encryption is done, This is problematic for the ransomware, as they want the client key to be gone from the client asap making it impossible to stop the process mid way and capture the client key. By making a separate key per file, and encrypting that with a client public key with private key long gone this is averted. Even if you catch the process half way through you can't undue what is done without interacting with the holder of Spriv(paying the ransom).

Think of all the good that could be accomplished if the clever people writing malware actually directed their skills in a positive direction?