Question: I'm working on malware analysis at my university and I'm trying to develop ransomware. I'm planning to publish the source code after it's finished. Is there any open source ransomware sample so I can take a look?

Answer: 
No. There is not and I am quite sure there will never be: imagine nuclear weapons are available to buy in the shop.

The spirit of the Open Source community is luckily investing positive efforts to develop tools that protect users ranging from anti viruses such as [ClamAV](http://www.clamav.net/index.html) to web vulnerability scanners such as [Grabber](http://rgaucher.info/beta/grabber/), passing by tools that are rather intended to assess users' systems such as [those](http://tools.kali.org/tools-listing) you can find in Kali Linux used for pentesting (of course, you can always use the knife to kill someone instead).

But it is true that there are some open source *nefarious* tools such as [ZombieBrowserPack](https://github.com/Z6543/ZombieBrowserPack) which is a plugin can be manipulated remotely to steal authentication credentials and even bypass two-factor authentication mechanisms such as the ones implemented by Yahoo and Google, or simply hijack your Facebook account and much more. However, this must not lead to misunderstanding: this plugin is developed by [Zoltan Balazs](https://nl.linkedin.com/in/zbalazs) as a POC for academic purposes as similar other tools in the same context: virus code is present freely on Internet but it is intended for academic purposes and it can not harm because any malware which code is released its life is ended as anti-virus companies conceive a protection against it.
"[The Zoo](https://github.com/ytisf/theZoo)" is a good source of malware for research, including some ransomware. [This](https://github.com/ytisf/theZoo/tree/master/malwares/Source/Original/Ransomware.Jigsaw), for example, is ransomware:

Modern ransomware does not typically use just a symmetric key or operate via the mode described in some of the other answers. A method of operation more closely related to "real world" ransomware looks like this:

* Generate a unique asymmetric key pair on the ransomware server
* Send the public key to the victim machine for use with ransomware client (already lying in wait on victim machine)
* For each file in list of files to encrypt:
* ... generate random symmetric key (e.g., AES key)
* ... encrypt file with random symmetric key
* ... encrypt symmetric key with asymmetric public key
* ... replace file with symmetric-encrypted file concatenated with public-key-encrypted symmetric key

In this manner, each encrypted file has its own symmetric key encrypted with the unique public-key. Thus the only possibility of recovery is by purchasing the private key, which only exists on the ransomware server.