201209241229 10dj2m
explained decrypted filler
3DES(name+title) ECB, 18 GUIDs, seed 530
From the post to its content
As posted (encrypted)
1800A6EA7BA26F58 5E58623F21807B3D E7109D233D50CF77 6E02C2AABD7192AD 5FD3B39C840DAA04 C6CAAAEBB1CA0BB0 22BF472EAAC96CFB ED4734BC7E4A9D0E 67F010D4FB8B0D96 F38F0F427EFEBA92 28258DEFB3F54E06 C4D2CB0CD5C15DD7 4CFA3D1193705BB3 8E003B4AEED42927 E23644463790BB96 9744E452E6025B60 C09EDD870091B188 B6315868FFB194D7 D8F63168EBC33177 B70643BDFD013E09 63D4F3806FA6C3ED 4610FAC32D217EE1 14E0697D90E4CE37 C8E268FE7AA58AC0 EB3474AD666E5E8B DA3AF2D6D0BAE6D4 CBBA524485F33D85 6C5914EC65F586AF D0B6C4373621AF25 AB2785302631B8D9 46E1F9F2FF6815C1 E05122EA1A59F9EB 54759A0344C0F396 BF1197C257870B8F 06511B32B98FC487 79EAD46CE1368373 5A3A282D7AC5DF8C 25341C328AE9F1B9 B2550CA02D4529B7 1FA4EC25190D7E31 06E4DB9643AA2E3B FF4750E57C79ECE8 06F99658ECB83F7F E0AB81EEDAE2F892 45CCFF3FD3490199 9B3610C9C73E9229 CB119E325F773A9F 3A40947E0323842F 0D1DD5B1C48860E6 C15966FB019B64F4 6DD9F6D6FBE98B66 7D0AF1B5ED7D9FB9 39B34FEEEC3D2F02 CBFCCC368F6025C1 DE48E12F27827299 FA2EB8D69BA365F8 518253F857DA10E6 7AAB73EBED2590BC 6FE947017727F2E1 6D48718E77F3D346 AE0E2954B7FFE2DB F5A04BACD2CF7C5A FDCDCAE2AE756138 6572FE6FFEA4FB47 00CE6839ADFBF23A 2582901DA190A1D7 F8F4D64B0AD3F5E3 D4732D80D8B3E7B8 5753FC6D9991B400 16DC403E6EF38B10 3E015AF8A608AA15 DAB1AF81C66D8A8F 196B0E872CB411AF
- Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9201209241229(name+title). Key = MD5(password) =864c4522e03b95a737efef479ebb41f5, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).
Decrypted: GUID list
1 f365e767-ee83-5e1f-b361-43befe3a616f 2 f980c155-04fb-202b-b2ae-5ee965218e7a 3 67f2ef36-2f7c-2bfb-98b0-7574be7ad2d9 4 5ce2b6ef-92ee-6b3a-8c1d-e0e462595aca 5 030bdd52-bbb0-4673-b323-228c3232f7cb 6 98607400-f775-66c1-aeac-f7ae1035e041 7 590fbbb5-cc71-3286-9545-d9dc75118b38 8 e98bd77f-f6b0-3641-a09c-db27541c7bc1 9 a19fe5bb-8faa-46bb-be1d-d61fd0f28882 10 a6ccffa4-ac0c-6734-85df-7dac11f11f7c 11 3df14e25-d409-6157-8625-86e5306fc483 12 91647a44-a7c6-20eb-a577-9ab8b4b4ae8e 13 11961ca8-62d3-8ddb-9789-dde4a36bf981 14 c2d61db4-6d6f-1a37-a5a2-d77440f74098 15 9cb5166a-1c95-8b65-9e98-94fbc732eb50 16 51d4abd9-77dc-0cdf-9e90-4ceb61d40c00 17 b3807216-df3a-5583-8f6e-5389489fb7a4 18 98cff5d3-2658-5e01-892d-d5a10438f8fb
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
522646334662818055. Exactly this sequence comes out ofnew Random(530).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 165 of Run 34 (seed 83,105,000):
new Random(83105000), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24). - Conclusion. Filler. The content is fully explained by the two RNGs.