The first step is to encipher the plaintext using some mode of operation of the conventional block cipher.
Ransomware may encipher portion of their data, using an encryption algorithm, like Salsa20, RSA or AES.
Antonyms