Cryptopometry as a Methodology for Investigating Encrypted Material

2 Problem Description

The investigation of subject A is initiated and a forensic image of the hard disk drive (HDD) is taken. Analysis is carried out and it is found that there is a significant amount of ciphertext files and plaintext files containing evidence. Subject A is a suspected distributor/seller of KP and subject B whose identity is unknown is the recipient of the encrypted material. The objective of this research is to establish an evidential link between the encrypter and the recipient of PGP encrypted material and subsequently identify the plaintext file that was encrypted. In this scenario subject A must have had subject B’s public key (PK_B) and PGP encrypted the plaintext material (M) to form the ciphertext (C_B)_. Subject B can decrypt the ciphertext when he receives it with his private key (PVK_B), please see Figure 1. PGP is a hybrid cryptosystem where the ciphertext created by it follows the OpenPGP message format specified in Callas et al. (2007). A hybrid cryptosystem is a combination of symmetric and asymmetric encryption. A symmetric key is session generated and then this is used to encrypt data. The symmetric key is then encrypted using the recipient’s public key. The public key can be stored and distributed by a key server. The symmetrically encrypted data and the asymmetrically encrypted symmetric key are the major components of a PGP ciphertext data-packet. PGP also compresses data before encryption for added security because this helps remove redundancies and patterns that might facilitate cryptanalysis, compression is only applied to the symmetrically encrypted data-packet. PGP uses the Deflater (zip) algorithm for compression.

Figure 1.

Problem description