Can an AES-256 key be generated for a large number of cribs? I have a question in regards to Ransomware type viruses. I know that a number of these viruses use the AES-256 algorithm to encrypt user's files using a randomly generated key. I work in IT support and I had one client the other week who had lost a large number of important files this way but one thing which struck me was that we were able to recover a large number of files via DropBox - about 500 files (~2gb worth of data) and because the virus only changed the extension it was clear which unencrypted file corresponded to which encrypted file.

What I was wondering is; with a large dataset like this where you have both the encrypted and unencrypted data would it be possible to calculate the encryption key for an AES-256 algorithm in a reasonable time? I don't know how these algorithms work but presumably you would have so much data available to compare that it should at least make the task considerably easier should it not?

I'm not intending to rid the world of ransomware but it just interested me!

Cheers,

Olly
Just the most basic research on this site would have told you, the answer is NO.

From all known cryptanalysis on AES, the answer is simply there are no useful plain-text attacks. (Which is essentially what your "cribs" are.

It's not going to be possible to break AES-256 in your clients scenario. Full key recovery is out the picture even with a terrible implementation, unless there's a weak way that key is stored. Finding the AES key on the computer itself (encrypted using more vulnerable techniques) is your only shot in hell.