# Why can't ransomware practically use RSA to encrypt all files?

I understand that a few ransomware have used an RSA public key to encrypt all files belonging to the victim. This is a bullet-proof system in terms of its security because the private key is always safe with the hackers.

But most ransomware use the hybrid encryption approach and during that they make mistakes allowing security researchers to build decryptors. The attractiveness of this hybrid approach lies in the speed of symmetric encryption. But because the hackers makes implementation mistakes in this approach, why don't all hackers switch to asymmetric-only encryption? It seems easier to implement programmatically than the hybrid approach. Is slow speed of RSA the only factor the limits the hackers? How slow is RSA when compared to AES for, let's say, 500 MB of data on an average i5 processor?

I have searched the Internet looking for a comparison between speeds of RSA versus AES for bulk data encryption in modern computers but found nothing. I understand that criminals cannot be reached for comment on why they don't use asymmetric-only approach for bulk encryption but I am looking to understand what could be the practical reason behind why bulk encryption with RSA is so undesirable.

• "It seems easier to implement programmatically than the hybrid approach." [citation needed] what exactly is the encryption scheme you're proposing? – Maeher Feb 18 '20 at 8:44
• I don't think this is is very particular to this scenario to be honest, it is just the same as with any encryption scheme, ransomware or not. – Maarten Bodewes Feb 18 '20 at 13:58
• AES vs RSA is not the issue. AES when used correctly is virtualy impossible to break. The weakness is in the key management. – shumy Feb 18 '20 at 14:24

RSA is really very slow compared with symmetric ciphers. You can check this yourself running e.g. openssl benchmark:

openssl speed rsa


On my machine (and with openssl 1.1.1a) I get

Doing 2048 bits public rsa's for 10s: 330640 2048 bits public RSA's in 10.00s


so we can do ~33k encryptions per second and the size of the encrypted block is less than the modulus, so less than 256 bytes. If the attacker wanted to encrypt 1GB file, it would take about 2 minutes. On the other hand,

openssl speed aes


shows that AES-CBC can encrypt ~300MB per second

type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
aes-128 cbc      94234.08k   136019.99k   137980.25k   304759.81k   304166.23k   315654.14k


so the same 1GB file would be encrypted in 3 seconds.

For the attackers, speed is important, since the faster the files are encrypted, the less likely the process will be interrupted.

• "RSA" is also not an encryption scheme. Now you could use a secure RSA based encryption scheme like RSA-OAEP, but how you extend this to long messages without atrocious ciphertext expansion is not necessarily clear. – Maeher Feb 18 '20 at 8:53
• @Maeher Yes, you need to use RSA in an encryption mode, like you said e.g. RSA-OAEP (that's why I said " the size of the encrypted block is less than the modulus" because we need padding). Since the security requirement for a malware is just inability to decrypt for known plaintexts and not stronger properties like CCA2, most likely basic modes like ECB or CBC would be sufficient. – Krystian Feb 18 '20 at 9:04
• Yes you can do blockwise encryption if you only need CPA security (which should indeed be fine for the application). But the ciphertext expansion would be pretty horrible compared to just using hybrid encryption. – Maeher Feb 18 '20 at 9:09
• @Maeher: Agreed, the ciphertext expansion incurred by RSA-OAEP is a major issue for essentially in-place file encryption use case required by ransomware. – Krystian Feb 18 '20 at 10:00

First of all, this idea is based on a misconception:

"But most ransomware use the hybrid encryption approach and during that they make mistakes allowing security researchers to build decryptors."

This is my opinion is not correct. The first ransomware used just symmetric encryption. Now if that symmetric key is left then it may be possible to retrieve it again. You must make a terrible mistake in the implementation if you use hybrid cryptography with separate symmetric keys per file. Now there will of course still be a ransomware nitwit (these are not high payed professionals) that still managed to screw it up, but I don't believe that that is common.

I have searched the Internet looking for a comparison between speeds of RSA versus AES for bulk data encryption in modern computers but found nothing.