It seems that CTB-Locker make a lot of victims nowadays, and yet, the full encryption scheme of it is now publicly known [1,2].

Would any of you could find a weakness to exploit in this encryption scheme that would be able to take it down once for all ? The point would be to recover the Master key or a way to circumvent the encryption.

See also:


No. One of the most important principles of cryptography is that knowing the encryption scheme cannot help someone attempting to decrypt the material without the key. The encryption used seems to be a reasonably well-written implementation of several standard algorithms, for which no practical attacks are known. Finding a way to crack these would be a major undertaking, one which many skilled cryptographers have already failed at.

| improve this answer | |
  • $\begingroup$ I didn't mean "breaking ECC" or "breaking AES", I was more thinking about an error in the way the things have been arranged to build the whole encryption scheme or specificities that are linked to the very peculiar way the encryption is used here. For example, if you have a partial back-up of your file, you will have access to a reasonable quantity of cleartext/ciphertext couple that you may use. Or, is there a flaw in the entropy of the chosen keys... But, of course, I believe in the security of ECC and AES... I am not that naive ! $\endgroup$ – perror Feb 18 '15 at 21:56
  • 2
    $\begingroup$ Then it goes to a probably not. The encryption scheme is pretty simple ECDH to compute a shared secret and then using a hash of that as an AES key. The implementation seems sound using the MS Crypto API where possible (AES, SHA-256, and the CSPRNG), and there are no known-plaintext or chosen-plaintext attacks on the ciphers used. The keys are generated with the MS Crypto API's CryptGenRandom, which is a good CSPRNG. I don't know about their implementation of curve25519, but that was designed to be easy to implement securely. $\endgroup$ – SAI Peregrinus Feb 19 '15 at 1:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.