I have some backup files encrypted with EFS, but I lost the EFS certificate--thus I am unable to decrypt the files. I understand that EFS uses the user certificate public key to encrypt the symmetric key (not sure how it's calculated) and then attach it to the file so later using the private key you can decrypt the symmetric key and thus use it to decrypt the file. I understand that this symmetric key is usually AES or a mix between other encryption algorithms such as SHA and ECC.

I do have full file binaries from before the encryption was done, and I still remember the Windows password and username used at the time of encrypting the files.

My question is: using this information, can I deduce the symmetric key directly without knowing the key pair?

  • $\begingroup$ One small point: note that SHA is not an encryption algorithm. It's the name of a family of cryptographic hash functions. $\endgroup$ – Patriot Oct 5 '19 at 4:33
  • $\begingroup$ While it is a bit late, you need the asymmetric key to recover the symmetric key. This is by design to protect the data in situations like you have (eg when the data is shared on some server). $\endgroup$ – SEJPM Oct 5 '19 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.