6 Added a final update with answers to my questions from Update 3.
source | link

Update 4: For anyone curious about the state of affairs, I found out the type of hash (a 10 byte/character random salt followed by the MD5 of salt + data); the algorithm is AES-256 in CBC mode without salt; and the data is compressed using LZ4 (which leaves some parts uncompressed, explaining the above partial decryption success).

For further updates on the latest format change which added salt, see https://github.com/marnix/synology-decrypt.

Update 4: For anyone curious about the state of affairs, I found out the type of hash (a 10 byte/character random salt followed by the MD5 of salt + data); the algorithm is AES-256 in CBC mode without salt; and the data is compressed using LZ4 (which leaves some parts uncompressed, explaining the above partial decryption success).

For further updates on the latest format change which added salt, see https://github.com/marnix/synology-decrypt.

5 Added that the files are also stored in _my_ cloud storage.
source | link

(Background. This Cloud Sync software stores a backup of my files for me in some cloud storage of mine in an encrypted way, and it gave me a key to keep safe, in case the software loses it, or I have to reinstall the software from scratch. Now, I'd like to be able to decrypt my files myself, without requiring the software to be running.

(Background. This Cloud Sync software stores my files for me in an encrypted way, and it gave me a key to keep safe, in case the software loses it, or I have to reinstall the software from scratch. Now, I'd like to be able to decrypt my files myself, without requiring the software to be running.

(Background. This Cloud Sync software stores a backup of my files for me in some cloud storage of mine in an encrypted way, and it gave me a key to keep safe, in case the software loses it, or I have to reinstall the software from scratch. Now, I'd like to be able to decrypt my files myself, without requiring the software to be running.

4 Made the question more specific, adding updated information about the vendor and their documentation
source | link

Which file encryption algorithm is used hereby Synology's Cloud Sync feature?

I'm trying to find out which encryption method is used by a piece of software I use, viz. the 'Cloud Sync' feature of Synology's DSM 6.0 running on a Synology NAS.

(Background. This Cloud Sync software stores my files for me in an encrypted way, and it gave me a key to keep safe, in case the software loses it, or I have to reinstall the software from scratch. Now, I'd like to be able to decrypt my files myself, without requiring the software to be running.

So I'm not asking anyone to "break the security of a specific system" here; I'm trying to find out how I can recover my own data that was encrypted by this specific Synology Cloud Sync software, given my own password / private key.)

As far as I've been able to reverse engineer the file format, each file is encrypted separately, and apart from the encrypted files no other information is stored. For each encrypted file the following data is stored:

Update 2: I just discovered that a (closed source) decryption tool is available from the vendor.

Update 3: Updated the above question to name the vendor and the software, after having having contacted the vendor (Synology). I discovered that the encryption/decryption algorithm is documented, but only on a high level.

All 'official' information about this encryption/decryption algorithm is on page 9 of "Cloud Sync White Paper -- Based on DSM 6.0" (archive.org copy) which I received through Synology Support.

This has a nice diagram explaining the high level algorithm:

  • a random 32-byte session key is generated;
  • the original file contents is encrypted using the session key;
  • the session key is encrypted through the "user-defined primary key" (= the password) through AES-256 (-> enc_key1);
  • the session key is also encrypted through a "randomly-generated key pair" (= public.pem for encryption, and private.pem for decryption) (-> enc_key2);
  • except for the session key itself, all of the above (and more) is stored in the encrypted file.

However, no other details are provided.

What I know so far is how to decode the file format, and that enc_key1 (which is stored in base64-encoded form) can be decrypted using OpenSSL through AES-256 in CBC mode, without a salt, using OpenSSL's undocumented password-to-key-and-iv algorithm, as follows:

$ echo 'f662PyjwrkzR61qSRHyBEVkXVd7STUpV6o7IrJs+m8gN1haqmBtMzLvq2/Gj134r' | openssl enc -aes256 -d -a -pass pass:'buJx9/y9fV' -nosalt
BxY2A-ouRpI8YRvmiWii5KkCF3LVN1O6

So that gives me the session key-- but I have not yet been able to use it successfully to decrypt the actual data.

Everything I know until now is now on GitHub in the synology-decrypt repository.

My goal for this question is to get at the full details, like:

  • How to actually use the session key to decrypt the raw data? I've tried AES-256 CBC without salt for that as well, and that results in half readable data, half garbage.

  • What about the 42-character hashes? As a specific example, continuing on the example above, how is session_key_hash jM41by6vAd517830d42bfb52eae9b58cd41eac95b0 the hash of the decrypted session key BxY2A-ouRpI8YRvmiWii5KkCF3LVN1O6?)

Which file encryption algorithm is used here?

I'm trying to find out which encryption method is used by a piece of software I use.

(Background. This software stores my files for me in an encrypted way, and it gave me a key to keep safe, in case the software loses it, or I have to reinstall the software from scratch. Now, I'd like to be able to decrypt my files myself, without requiring the software to be running.)

As far as I've been able to reverse engineer, each file is encrypted separately, and apart from the encrypted files no other information is stored. For each encrypted file the following data is stored:

Update: I just discovered that a (closed source) decryption tool is available from the vendor.

Which file encryption algorithm is used by Synology's Cloud Sync feature?

I'm trying to find out which encryption method is used by a piece of software I use, viz. the 'Cloud Sync' feature of Synology's DSM 6.0 running on a Synology NAS.

(Background. This Cloud Sync software stores my files for me in an encrypted way, and it gave me a key to keep safe, in case the software loses it, or I have to reinstall the software from scratch. Now, I'd like to be able to decrypt my files myself, without requiring the software to be running.

So I'm not asking anyone to "break the security of a specific system" here; I'm trying to find out how I can recover my own data that was encrypted by this specific Synology Cloud Sync software, given my own password / private key.)

As far as I've been able to reverse engineer the file format, each file is encrypted separately, and apart from the encrypted files no other information is stored. For each encrypted file the following data is stored:

Update 2: I just discovered that a (closed source) decryption tool is available from the vendor.

Update 3: Updated the above question to name the vendor and the software, after having having contacted the vendor (Synology). I discovered that the encryption/decryption algorithm is documented, but only on a high level.

All 'official' information about this encryption/decryption algorithm is on page 9 of "Cloud Sync White Paper -- Based on DSM 6.0" (archive.org copy) which I received through Synology Support.

This has a nice diagram explaining the high level algorithm:

  • a random 32-byte session key is generated;
  • the original file contents is encrypted using the session key;
  • the session key is encrypted through the "user-defined primary key" (= the password) through AES-256 (-> enc_key1);
  • the session key is also encrypted through a "randomly-generated key pair" (= public.pem for encryption, and private.pem for decryption) (-> enc_key2);
  • except for the session key itself, all of the above (and more) is stored in the encrypted file.

However, no other details are provided.

What I know so far is how to decode the file format, and that enc_key1 (which is stored in base64-encoded form) can be decrypted using OpenSSL through AES-256 in CBC mode, without a salt, using OpenSSL's undocumented password-to-key-and-iv algorithm, as follows:

$ echo 'f662PyjwrkzR61qSRHyBEVkXVd7STUpV6o7IrJs+m8gN1haqmBtMzLvq2/Gj134r' | openssl enc -aes256 -d -a -pass pass:'buJx9/y9fV' -nosalt
BxY2A-ouRpI8YRvmiWii5KkCF3LVN1O6

So that gives me the session key-- but I have not yet been able to use it successfully to decrypt the actual data.

Everything I know until now is now on GitHub in the synology-decrypt repository.

My goal for this question is to get at the full details, like:

  • How to actually use the session key to decrypt the raw data? I've tried AES-256 CBC without salt for that as well, and that results in half readable data, half garbage.

  • What about the 42-character hashes? As a specific example, continuing on the example above, how is session_key_hash jM41by6vAd517830d42bfb52eae9b58cd41eac95b0 the hash of the decrypted session key BxY2A-ouRpI8YRvmiWii5KkCF3LVN1O6?)

    Post Closed as "Off-topic" by Xander, LvB, Ohnana, Rory Alsop
3 Decryption tool exists.
source | link
2 Added info about role of password
source | link
1
source | link