Cryptographer here. Yes, in principle encryption is relatively easy to get right. The amazing story of ransomware is how often live ransomware packages have got

Cryptographer here. Yes, in principle encryption is relatively easy to get right. The amazing story of ransomware is how often live ransomware packages have gotten the basics wrong: everything from using sub-200-bit RSA keys to leaving the encryption keys in RAM on an encrypted machine [Wannacry]. There have also been private key recoveries from captured C&C infrastructure. This sort of least-effort incompetence is absolutely the best thing about the project of ransomware. The bad news is that they’re getting better at it, unfortunately.