I'm trying to find out which encryption method is used by a piece of software I use, viz. the 'Cloud Sync' feature of Synology's DSM 6.0 running on a Synology NAS.
(Background. This Cloud Sync software stores a backup of my files for me in some cloud storage of mine in an encrypted way, and it gave me a key to keep safe, in case the software loses it, or I have to reinstall the software from scratch. Now, I'd like to be able to decrypt my files myself, without requiring the software to be running.
So I'm not asking anyone to "break the security of a specific system" here; I'm trying to find out how I can recover my own data that was encrypted by this specific Synology Cloud Sync software, given my own password / private key.)
As far as I've been able to reverse engineer the file format, each file is encrypted separately, and apart from the encrypted files no other information is stored. For each encrypted file the following data is stored:
- a list of bytes, presumably the encrypted data, very likely compressed before or after encryption
enc_key1: 384 bits (48 bytes)
enc_key2: 2048 bits (256 bytes)
key1_hash: a 42-character string
key2_hash: a 42-character string
session_key_hash: a 42-character string
Each of the 42-character hash strings looks like this:
This seems to be 10 characters in some base64-like encoding (I see only letters, digits, and
-; this would be 60 bits), followed by 32 hex characters (128 bits).
The key the software gave me consists of two
.pem files, a private key (
-----BEGIN RSA PRIVATE KEY-----) and a public key (
-----BEGIN RSA PUBLIC KEY-----).
What encryption algorithm is used here? (And what's that weird 42-character hash?)
And how could I use the above information to restore the original file?
Update: Just discovered that there also is a password that plays a role, and each file can be decrypted using either the private key or the password; no need to have both.
Update 2: I just discovered that a (closed source) decryption tool is available from the vendor.
Update 3: Updated the above question to name the vendor and the software, after having having contacted the vendor (Synology). I discovered that the encryption/decryption algorithm is documented, but only on a high level.
This has a nice diagram explaining the high level algorithm:
- a random 32-byte session key is generated;
- the original file contents is encrypted using the session key;
- the session key is encrypted through the "user-defined primary key" (= the password) through AES-256 (->
- the session key is also encrypted through a "randomly-generated key pair" (=
public.pemfor encryption, and
private.pemfor decryption) (->
- except for the session key itself, all of the above (and more) is stored in the encrypted file.
However, no other details are provided.
What I know so far is how to decode the file format, and that
enc_key1 (which is stored in base64-encoded form) can be decrypted using OpenSSL through AES-256 in CBC mode, without a salt, using OpenSSL's undocumented password-to-key-and-iv algorithm, as follows:
$ echo 'f662PyjwrkzR61qSRHyBEVkXVd7STUpV6o7IrJs+m8gN1haqmBtMzLvq2/Gj134r' | openssl enc -aes256 -d -a -pass pass:'buJx9/y9fV' -nosalt BxY2A-ouRpI8YRvmiWii5KkCF3LVN1O6
So that gives me the session key-- but I have not yet been able to use it successfully to decrypt the actual data.
Everything I know until now is now on GitHub in the synology-decrypt repository.
My goal for this question is to get at the full details, like:
How to actually use the session key to decrypt the raw data? I've tried AES-256 CBC without salt for that as well, and that results in half readable data, half garbage.
What about the 42-character hashes? As a specific example, continuing on the example above, how is
jM41by6vAd517830d42bfb52eae9b58cd41eac95b0the hash of the decrypted session key
Update 4: For anyone curious about the state of affairs, I found out the type of hash (a 10 byte/character random salt followed by the MD5 of salt + data); the algorithm is AES-256 in CBC mode without salt; and the data is compressed using LZ4 (which leaves some parts uncompressed, explaining the above partial decryption success).
For further updates on the latest format change which added salt, see https://github.com/marnix/synology-decrypt.