[Cryptography] Cryptolocker

Paul Wouters paul at cypherpunks.ca
Thu Nov 21 22:18:56 EST 2013


On Thu, 21 Nov 2013, Greg Broiles wrote:

> According to Steve Gibson at https://www.grc.com/sn/sn-427.txt, when CryptoLocker contacts the central server(s), the servers generate a
> unique (per victim) 2048-bit RSA keypair; the public key is sent from the server to the infected machine. The infected machine generates
> a random 256 bit AES key, which is then encrypted with the public key and sent to the server, and used locally to encrypt the ransomed
> files. The key stored in the infected machine's registry is the public half of the RSA key.

I'm confused.

If the files are encrypted with a symmetric key, that key should still
be on the server and can be used to decrypt everything? It would make
more sense to encrypt it using the public key received, so nothing on
the infected machine could decrypt the data?

Paul


More information about the cryptography mailing list