Can you find the ransomware key if you already have decrypted files?

Question

Disclaimer: I have very very little experience with ransomware/encryption, so I'm sorry if I ask something stupid.

---

Ransomware attacks are all over the news, especially this year. And this got me wondering of a very typical situation in the real world:

• User X has many files on his PC
• He backs them up from time to time (he heard it's a good idea), but he's lazy and does it very rarely
• He gets infected with ransomware and all 10,000 of his important files are encrypted (10,000 is just an example here)
• However, the good news is that he backed up 1,000 of his files on an external hard-drive

So here's an idea for recovering the other 9,000 files: What if we have a software that compares the 1,000 encrypted files (from his infected computer) with the same 1,000 original files (from the backup) and tries to deduce the encryption key that way?

1,000 files should give you enough data to allow millions of comparison points and space for pattern searching, such that this becomes much much faster/efficient than a typical brute-force approach (e.g. 6 hours of compute-time instead of a typical 10 thousand years).

Once we find the encryption key (from the 1,000 to 1,000 comparisons), we can use it to decrypt the other 9,000 files and we don't have to pay the ransom.

---

So my questions are:

• Is something like this feasible/possible? Would it work? From what I've seen/heard (I was never infected with ransomware myself), the ransom message you get usually tells you what encryption method was used, how large the key is etc.
• Is this something that can work only with certain encryption algorithms and not with others?

If I were to guess, I'd say that the answer is NO for 2 reasons:

• if it were possible, someone much smarter than me would've thought about it and done it already
• finding such patterns and doing the comparisons implies being aware of weaknesses in the encryption system, which in turn implies a vulnerable encryption system. This means it will NOT be used in such attacks in the first place.

What are your thoughts on all this? (please remember the disclaimer at the top)

Answer 1

Yeah, you've pretty well answered your own question, but here's some more context.

It turns out that what you've come up with has a name, from wikipedia:

The known-plaintext attack (KPA) is an attack model for cryptanalysis where the attacker has access to both the plaintext (called a crib), and its encrypted version (ciphertext). These can be used to reveal further secret information such as secret keys and code books.

This is a fundamental security property that all modern ciphers need to be resistant to. Failing to be secure against known plaintext attacks would certainly count as a serious vulnerability, and the cipher would probably be considered "broken". Typically chaining block ciphers with unique Initialization Vectors (IVs) per file are used to frustrate attempts to find correlations between different plaintext-ciphertext pairs.