I received a decrypted file back from the hacker as proof that he could decrypt my files affected by his DjVU ransomware. Is it possible to find out which key he used to decrypt the encrypted file?
-
1Modern crypto is designed to protect against that. See Wikipedia for more information.– userOct 27, 2020 at 13:18
-
1Does this answer your question? security of AES where attacker can ask secure code to decrypt arbitrary cypher-text– userOct 27, 2020 at 13:22
-
No, if they uses AES-128 or AES-256– kelalakaOct 31, 2020 at 16:42
1 Answer
No.
Imagine you have a text file with some content M. The attacker then encrypts M with a key K, resulting in an encrypted file C.
By sending you back M, they don't directly prove that they have K, but since M is really what you are after anyways, that's alright.
The reason why it's not possible to tell anything about K is because M was created before K even existed. As such, it cannot possibly contain any information about K.
What you can do now
If you have a backup
Completely nuke your PC, re-install your OS from scratch and load your data from your backup. It might take a while, but it's better than paying ransom.
If you don't have a backup
The site No More Ransom might be able to help identify whether or not the particular ransomware used has flaws that can help recover the encryption key.
If you're lucky, then make a backup of your data now and then re-install your OS. That ransomware could have left behind some backdoors for future infections. Since you already paid once, you might pay again.
If you're not lucky, either pay the ransom or live with the fact that your data is gone. And even if you pay, you might be out of luck. Let that be a lesson to you to make proper backups.
-
Yeah, some of the ransom is purely written that it can't decrypt the data even if you have a key, but it is not like you can ask for refund.– netheroOct 27, 2020 at 20:34
-
If the attacker demonstrates they can decrypt arbitrary files, then it should be fine.– user163495Oct 28, 2020 at 10:33