Understanding ransomware – What makes plain-text-attacks or brute-forcing so hard?

Question

Say I have four files. Two are completely unencrypted, while the other two are the exact same files other than that they have been encrypted with (apparently) the same public key (via a ransomware virus). Is it possible to deduce the key from these files, so I can apply it to other files also encrypted with the same key?

Edit

Sorry, after searching through the questions related to my tags, I see the simple answer is no, because although the public key is easily discovered, it's probably a private key I'm looking for, which would be hosted elsewhere.

But to modify the question:

• Does the length of the public key imply the length of the private key, or can they be unrelated?
• Also, wouldn't more plaintext information provide a brute-force program a starting point to speed the process?

I don't understand why, given that all the files would be decrypted using the same key, we can't deduce said key by comparing encrypted files to unencrypted ones.

Answer 1

Does the length of the public key imply the length of the private key, or can they be unrelated?

Yes.

The sizes of public and private keys depend on the cryptosystem. Usually they are related somehow, but not necessarily. For example, you can store a short value as a private key, which is then used as a PRNG seed to generate the private key used in the actual algorithms.

In RSA a private key file typically includes a lot more information than a public key - in addition to those modulus and public exponent that the public key contains, it includes the private exponent, as well as usually the original primes and some CRT values.

However, raw RSA keys only need to contain the modulus and the private or public exponent, so they can be the same size.

Also, wouldn't more plaintext information provide a brute-force program a starting point to speed the process?

No, typically not. An encryption algorithm where this is true (at least for values smaller than other attacks) is considered broken. Because of the below.

I don't understand why, given that all the files would be decrypted using the same key, we can't deduce said key by comparing encrypted files to unencrypted ones.

If you could do that, then the public key system would not be very useful would it? Anyone who has the public key can encrypt any number of files they want. Thus, they have any number of plaintext-ciphertext pairs they could want. If this made the algorithm weak, it would be completely useless (except maybe as a replacement for a symmetric, i.e. secret key algorithm).

You might find questions such as this helpful: Is there an intuitive explanation as to why only the private key can decrypt a message encrypted with the public key?