18

Some of my files have been encrypted by ransomware. I can find some backup of files (unfortunately not all of them). Can I find the password of the 7Z zipped+encrypted files if I also have some of the original files?

3
  • 7
    If the files were encrypted using a pre-2019 version of 7zip, there may be hope. See security.stackexchange.com/questions/100650/… for more info.
    – mti2935
    Sep 23 at 16:24
  • 3
    Do you have the ransomware payload by any chance? Maybe submit it to VirusTotal?
    – Adam Katz
    Sep 23 at 21:37
  • 2
    1) Do you know anything about the password, for example its length and the characters used in it? 2) Some ransomware has been cracked and the decryption is publically available. Sep 24 at 16:22
26

7z uses AES-256 with the CBC mode of operation for encryption. Since AES in CBC mode is resistant to known-plaintext attacks ( The CBC mode has greater security than KPA, it has Ind-CPA), having the original files will not assist you in cracking the key/password used for encryption.

mti2935 and Adam Katz point out that 7z used a broken IV generation mechanism up till 2019. While detrimental to secrecy of the encrypted data, as far as I can tell, it only leaks information about the plaintext. I'm not a cryptographer and can't state this authoritatively, but I don't think the weak IV enables attacks against AES that would allow recovery of the key/password faster than brute force. (Edit: Someone with sufficient cryptographic knowledge has commented, confirming that the attack on weak IVs is not a key finding attack.)

4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.