Why can't ransomware practically use RSA to encrypt all files?

Question

I understand that a few ransomware have used an RSA public key to encrypt all files belonging to the victim. This is a bullet-proof system in terms of its security because the private key is always safe with the hackers.

But most ransomware use the hybrid encryption approach and during that they make mistakes allowing security researchers to build decryptors. The attractiveness of this hybrid approach lies in the speed of symmetric encryption. But because the hackers makes implementation mistakes in this approach, why don't all hackers switch to asymmetric-only encryption? It seems easier to implement programmatically than the hybrid approach. Is slow speed of RSA the only factor the limits the hackers? How slow is RSA when compared to AES for, let's say, 500 MB of data on an average i5 processor?

I have searched the Internet looking for a comparison between speeds of RSA versus AES for bulk data encryption in modern computers but found nothing. I understand that criminals cannot be reached for comment on why they don't use asymmetric-only approach for bulk encryption but I am looking to understand what could be the practical reason behind why bulk encryption with RSA is so undesirable.

Answer 1

RSA is really very slow compared with symmetric ciphers. You can check this yourself running e.g. openssl benchmark:

openssl speed rsa

On my machine (and with openssl 1.1.1a) I get

Doing 2048 bits public rsa's for 10s: 330640 2048 bits public RSA's in 10.00s

so we can do ~33k encryptions per second and the size of the encrypted block is less than the modulus, so less than 256 bytes. If the attacker wanted to encrypt 1GB file, it would take about 2 minutes. On the other hand,

openssl speed aes

shows that AES-CBC can encrypt ~300MB per second

type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
aes-128 cbc      94234.08k   136019.99k   137980.25k   304759.81k   304166.23k   315654.14k

so the same 1GB file would be encrypted in 3 seconds.

For the attackers, speed is important, since the faster the files are encrypted, the less likely the process will be interrupted.

Answer 2

First of all, this idea is based on a misconception:

"But most ransomware use the hybrid encryption approach and during that they make mistakes allowing security researchers to build decryptors."

This is my opinion is not correct. The first ransomware used just symmetric encryption. Now if that symmetric key is left then it may be possible to retrieve it again. You must make a terrible mistake in the implementation if you use hybrid cryptography with separate symmetric keys per file. Now there will of course still be a ransomware nitwit (these are not high payed professionals) that still managed to screw it up, but I don't believe that that is common.

I have searched the Internet looking for a comparison between speeds of RSA versus AES for bulk data encryption in modern computers but found nothing.

Oh dear, you must up your Google-fu.

---

The other answer mentions encryption speed, but there is more to it than that. I think that the encryption speed of RSA is not such a problem that needs to be a huge problem. However, there is another disadvantage: efficiency when it comes to size.

If you encrypt a plaintext using RSA then you will have a certain disadvantage when it comes to ciphertext expansion compared to the plaintext. How big the ciphertext expansion is depends on the padding scheme used. For RSA PKCS#1 v1.5 padding you can go as low as an overhead of 11 bytes (although larger padding sizes are more secure). For OAEP, well, somebody created a table here. So if you e.g. use RSA PKCS#1 v1.5 with a 2048 bit key you'd expand the ciphertext with 11 bytes per 256 - 11 = 245 bytes. That means that files will suddenly be a lot larger (something that might be very noticable) or you might of course run out of disk space to perform the encryption at all.

Another problem is that RSA requires the use of a random number generator to generate the padding (well, unless deterministic scheme is used, but that would be overestimating the prowess of the ransomware creator). If you keep hitting the random number generator then it may decide to request additional entropy, and that means that your system may run out of it. When it runs out, it will stall or the speed will likely degrade to a crawl. That will be rather noticeable, especially if there are other applications that request random data from the system.

Finally, although the encryption speed may still be enough to encrypt lots of data, it is questionable if the decryption speed will be sufficient. Decryption speed is much lower for RSA than encryption speed. That said, the person or persons behind the ransomware will probably not care all that much.