1

I've been sent a series of files that I need access to, along with a password. Unfortunately, I haven't been told how the files were encrypted.

I can see that the encryption process has added the extension ".XML" to each of the encrypted files. The files then have the following XML header (line breaks added for readability, hashes cut out in case they turn out to be secure info), a line break, and then what I presume to be the actual encrypted file contents.

<?xml version="1.0" encoding="UTF-16"?>
<!--GETRSFileHeaderSize=0x00000BF2-->
<GETEncryptedDataFile version="x.x.x">
<FileInformation>
<filename>
(Windows File Path was here)
</filename>
<created>Tue, 18 Nov 2014 15:56:21 UT-0000</created>
</FileInformation>
<AlignmentLength>512</AlignmentLength>
<WrappedKeys iv="value here" hash="value here">
<Certificate hashmethod="kdf2">
<wrappedkey method="rc4">very long value here</wrappedkey>
</Certificate>
<UPC hashmethod="kdf2"><wrappedkey>value here</wrappedkey>
</UPC>
</WrappedKeys>

I think this (plus the password) should be everything I need to decrypt the file, but I'm really struggling at the "how" part.

I have tried the following to drop the third (encrypted) line of the file into openssl to decrypt, but it gives the response "bad magic number".

sed -n '3p' filename | openssl enc -rc4 -d

I guess I need to use the hashes and keys provided in the XML header, but that's where I'm stuck as I've not done a lot of encryption stuff.

3
  • 1
    Why don't you just ask the sender?
    – DavidPostill
    Nov 26, 2014 at 9:30
  • They're not very technical in a fairly bureaucratic org - they didn't even realise files were being encrypted and couldn't understand why we couldn't open them. I'd like to have a crack at unlocking them myself before waiting for their IT department's machinations. Nov 26, 2014 at 9:35
  • For those who've dug this far (as apparently 2500 of you have - xkcd.com/979 ) we never got this resolved. It appears to be that the sender has Symantec Endpoint Encryption in place, but we were never able to confirm that. The bureaucracy never got around to giving us whatever it was that is needed to decrypt the files. Mar 14, 2017 at 12:41

1 Answer 1

4

If you search for some of those XML tags (like "GETEncryptedDataFile"), you'll find that they seem to be associated with Symantec Endpoint Encryption Removable Storage. There seems to be a trial version of this that you could play around with, but given that your file has a "Certificate" tag, that suggests to me that the encryption uses a certificate on your sender's computer, which you presumably don't have. So, I wouldn't bother trying...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .