2
$\begingroup$

Thinking about the rather new problem of Cryptolocker and other crypto-randomware, huge amounts of damage are being caused by malicious actors simply using modern encryption algorithms to encrypt a drive. But this presents an interesting question, and the hint of a possible solution:

Could a collection of data be engineered such that when it is encrypted using a given encryption algorithm, say RSA, patterns in the encryption reveal details that could be used to discover the keys, or at least greatly narrow the search space?

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ You are asking about chosen-plaintext attack against current crypto algorithms. This is better asked at crypto.se. $\endgroup$
    – Steffen Ullrich
    Aug 22, 2016 at 13:26
  • 2
    $\begingroup$ No. For any reasonable construction of a modern algorithm, if this were possible, it would be a fatal flaw. $\endgroup$
    – Xander
    Aug 22, 2016 at 13:41

2 Answers 2

Reset to default
2
$\begingroup$

What you're describing is a chosen-plaintext attack. In this scenario the attacker (you, in this case) creates a specific plaintext for the cryptosystem to encrypt, in an attempt to manipulate it in specific way...In your scenario, to get it to give up information about the key. Chosen plaintext attacks should not be possible in a semantically secure cryptosystem. If they are possible, the system is broken, and should not be used.

So, to directly answer your question, no, this should not be possible, and certainly is not generically possible. There may be specific implementations of crypto-ransomware that are flawed in a way that would make this possible, but you would have to specifically target an attack for that specific system, and it would be useless against any other, including another system flawed in even a slightly different way.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Does this mean that it is provably impossible to, for example, algorithmically deduce encryption keys using chosen plaintext, or simply that such an algorithm for, say, AES has not yet been found? $\endgroup$
    – TheEnvironmentalist
    Aug 24, 2016 at 0:00
-1
$\begingroup$

This is a brilliant idea, but I don't know of a way to make it viable.

Presumably, you're thinking you could do something like have a file named "my_photo_1.jpg" where it's been specially constructed so if the first bit of the key is a "1", the encrypted file contains some data revealing that key bit, "my_photo_2.jpg" is structured so that it reveals another key bit, etc. These are called "chosen plaintext attacks".

So that leaves hope for a vulnerability in the encryption algorithm used by the extortionist. Unfortunately for your idea, if the extortionist is using AES, the best chosen plaintext attack published so far is an improved variant of the Square attack, which works on reduced (seven) round variants of AES. Cryptographers study reduced-round variants in order to search for weaknesses in algorithms, but real world applications of AES follow the published standard and use 16 rounds. While the knowledge gained from reduced-round variants is helpful, they can't be applied in practice to solve this problem. Yet.

Chosen plaintext attacks are normally not very practical against a real-world adversary, because most traditional adversaries aren't likely to encrypt a bunch of random messages that might weaken their cyphers. But in this case, where the encryption is hostile and you control all the plaintext, it's a perfect application. This might spur further research into this field.

--

Unfortunately, this can't work for RSA as you suggest. RSA uses two different keys, a public and a private key, and only the public key is distributed with the malware. (The private key is kept confidential on the extortionist's servers, to be sent to the victim only after the ransom is paid.) RSA is used only to encrypt the random number used as the key to the symmetric algorithm, which is used to encrypt the files. Chosen plaintext encrypted with the public key doesn't reveal anything about the private key.

Improve this answer
$\endgroup$
5
  • $\begingroup$ While it is an interesting question to swap around the points of view (encryption done by the attacker), any attempt to weaken encryption deliberately is a bad thing. Even if there are encryption schemes with such a weakness (I'd call it a honeypot), why should the attacker consider to use them instead of proper ones? $\endgroup$
    – tylo
    Aug 22, 2016 at 16:06
  • $\begingroup$ @tylo, I'm not suggesting "weakening" the encryption. I'm suggesting that if the malware uses an algorithm that has a chosen plaintext vulnerability, it might be possible to pre-create a set of files that exploit it. Yes, the attacker is probably using AES and so it won't be vulnerable to any known attacks. But as is often said around here, "attackers always get better." $\endgroup$
    – John Deters
    Aug 22, 2016 at 16:16
  • 1
    $\begingroup$ Well, if the malware is using bad crypto, then it is also no problem in breaking it. But calling it a "brilliant idea" is giving a false impression, and "this might spur further research" suggests, that it might be useful somehow in the future. But from a research point this is already quite clear: The attacker chooses the encryption scheme, and a serious attacker will not choose a vulnerable one. So this "counter measure" would have to be considered as snake oil. $\endgroup$
    – tylo
    Aug 22, 2016 at 16:36
  • $\begingroup$ I consider it brilliant because it's the first instance I know of where a chosen plaintext attack would be practical. $\endgroup$
    – John Deters
    Aug 22, 2016 at 16:38
  • 2
    $\begingroup$ @tylo and John, please don't call the miscreant attacker. Maybe call the miscreant extortionist. An attacker is a specific entity in crypto-analysis that indicates the person trying to break the cryptographic system. In this case that's - strangely enough - the legit user of the IT system. $\endgroup$
    – Maarten Bodewes ♦
    Aug 22, 2016 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.