how ransomware encrypts your files so fast (and where the design breaks)

ransomware encrypts tens of thousands of files in minutes. that raises an obvious question: encryption is supposed to be slow and heavy, so how is a random payload on your machine chewing through a whole drive faster than your antivirus can react? the answer is that it never actually encrypts your files with the big key. it uses the classic hybrid scheme, and once you see the structure, you also see where it's fragile.

the problem the attacker has to solve

take a normal encryption setup. you have a strong key, you encrypt everything with it, done. but the attacker is not there. the machine is sitting in someone's office, offline, and the attacker needs to be the only one who can decrypt it later. so:

• the decryption key has to reach the attacker somehow
• but the key can't just sit next to the encrypted files, or the victim could find it and unlock everything for free

that's the tension. encryption alone doesn't solve it. you need encryption that only the attacker can undo. enter asymmetric crypto.

the hybrid scheme

where a real ransomware design usually lands:

1. the attacker generates a key pair: a public key (sits inside the payload, on the victim's disk, totally visible) and a private key (stays on the attacker's server, never transmitted)
2. on the victim's machine, the malware generates a random AES key, unique per victim or per file, and encrypts the actual file data with it. AES is symmetric and fast, which is why your whole drive is gone in minutes and not in a week
3. it encrypts that AES key with the attacker's RSA public key and stores the result alongside the encrypted files. this step is tiny: one key, a few hundred bytes
4. the victim can read the encrypted AES key all they want. it's useless without the RSA private key, which only the attacker has

files : AES, fast > encrypted data
AES key : RSA public, tiny step > encrypted key (stored with files)
                                     |
                        RSA private key (only on attacker's server)

the beauty, from the attacker's side, is that they just hand you the lock and keep the only key. no key material ever crosses the network during the attack, which is also why proper ransomware works even on a fully air gapped machine. it doesn't need to call home to encrypt you.

why it's so fast

the only expensive cryptography is the RSA step, and it runs once, on a few hundred bytes. everything heavy is AES, and AES on a modern CPU is fast, on the order of gigabytes per second for a single core. add the AES-NI instructions that basically every x86 CPU has had for a decade, and you get disk-speed encryption. the actual limit is your drive's read and write speed, not the crypto.

a rough demo of the shape, so it stops being hand-waving:

# symmetric, the fast part (aes-256-cbc here)
openssl enc -aes-256-cbc -salt -in secrets.txt -out secrets.txt.enc

# the key was generated like this, then wrapped with rsa
openssl rand -out aes.key 32

# and the wrapping step, the slow one that only happens once
openssl rsautl -encrypt -pubin -inkey attacker.pub -in aes.key -out aes.key.enc

run the aes line over a big file and time it. tens of megabytes a second easily, hundreds if your CPU is decent. that's the whole reason a full disk can be gone before you finish your coffee.

the part the movies skip: where the design breaks

this scheme is the standard, and it's also why criminal groups started getting hit after encryption.

• keys in memory: to encrypt thousands of files fast, the malware generates or loads the AES key(s) in RAM. if the victim notices quickly enough and yanks the power, memory forensics can sometimes recover keys still resident. some modern variants keep keys only in memory and never write them, which kills that avenue, which is exactly why the powers-off advice stopped being universal
• bad crypto is common: a shocking amount of real ransomware shipped with weak RNG, reused keys, or broken implementations. there's a whole cottage industry of decryptors released by researchers precisely because the attacker's code was worse than they thought
• hybrid means one weak link: the entire thing rests on that RSA private key on the attacker's server. if law enforcement seizes the server, or the operator's own infrastructure leaks, every victim unlocks at once. the scheme is mathematically solid and operationally fragile
• and the biggest break of all: backups. the design assumes you need the attacker's key to recover your files, and that assumption is only true if the only copy of the data is the encrypted one. offline, tested backups make the entire mathematical edifice irrelevant

what this means for defense

a lot of "crypto" advice is really about this structure:

• don't let files be encrypted in the first place: immutable backups, offline copies, versioning. the scheme can't touch what it can't reach
• detection has to be behavioral and fast: the writes pattern is the giveaway. thousands of writes under a second, entropy in file contents jumping from text to random, file extensions changing en masse. signatures rarely catch this, behavior does
• and the key point most people never internalize: if you see lock screens or note files, the encryption already finished. the window where you win is before, which is why storage-side protection keeps beating endpoint protection here

resume

• ransomware uses hybrid crypto: AES for speed on your files, RSA to wrap the key so only the attacker can undo it
• the only slow step happens once, on a few hundred bytes, so the real limit is disk speed, not crypto
• keys sit in memory while it runs, which is a narrow window for forensics
• the design breaks at the attacker's key handling, and at the fact you had a backup: that last one makes the whole scheme moot
• detect it by write patterns and content entropy, not by trying to find a signature