0

I'm trying to decrypt JPEG and MP4 files (basically, media files) which they end in .enc file extension, encrypted with AES-256.

For each file, a .key file is associated, the file size is 48 bytes, which probably contains a passphrase + IV.

Cannot find a solution online and have no other documentation associated to the files. There is another question similar to that, but the person Is trying to decrypt a HLS stream and the answer does not solve my problem.

The key is not in plain text, all unreadable special characters.

Improve this question
3
  • 3
    It's impossible to give you an answer based on the information you've provided. There are lots of different cryptographic algorithms and lots of implementations with different formats. There's no magical decrypt-everything approach. You'll have to find out how exactly the plaintext was encrypted. Since you somehow got the keys, you should be able to ask the right person or check the code which was used.
    – Ja1024
    Jun 2 at 19:21
  • @Ja1024 Sorry, I didn't say enough informations about encryption method, I updated the question. Seems like the file is encrypted in AES-256 and the Key is composed of both passphrase and IV, but the Key is not in plain text
    – Northumber
    Jun 2 at 20:38
  • OP, is the number of bytes in the .enc file a multiple of 16?
    – mti2935
    Jun 2 at 20:59

1 Answer 1

Reset to default
2

Its very difficult to decrypt the data without having more info regarding the exact encryption used. After reading your comment If we assume that AES-256 CBC is used, and IV is 16 bytes (out of the 48 bytes) which typically is in this mode, then you could try to use openssl to try to decrypt this data like so:

#!/bin/bash

pass_file="file.key"
data=$(cat "$pass_file")

keybytes="${data:0:32}"
ivbytes="${data:32}"

keyhex=$(echo -n $keybytes | xxd -p -c 64)
ivhex=$(echo -n $ivbytes | xxd -p -c 32)

openssl aes-256-cbc -d -K "$keyhex" -iv "$ivhex" -in encrypted.enc -out decrypted.mp4

but again this won't work if another encryption scheme is used.

Improve this answer
2
  • Nice answer (+1). But, I believe the key and iv must be passed to openssl in hexadecimal format, not raw bytes - otherwise openssl will throw 'invalid hex value'. See the edit I made to the script to correct this. OP, if this doesn't work, you might want to try changing lines 6 and 7 so that it looks for the key and iv in the opposite order, i.e. the iv in the the first 16 bytes and the iv in the last 32 bytes.
    – mti2935
    Jun 3 at 13:02
  • @mti2935 oh yes thanks for the edit, you're right about the hex I just confirmed from the wiki
    – game0ver
    Jun 3 at 13:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .