201210071445 113is5
explained decrypted filler
3DES(name+title) ECB, 20 GUIDs, seed 558
From the post to its content
As posted (encrypted)
012650AEDB8E3ABA 9BDD4DD91670356B D010851376AE93E2 DDBB2E9F63FDBF36 18E658A41DEE3708 75C4BEA551E40AA1 7F0BFC3F6E693D58 CB94B1422D817403 BB104BC2F27FE2B3 643E91F679DF8AF3 B8378748C4C9E91D 7B1CAB7DB321613D 70CE52B675BC0EB2 656102A17D6A23DC 7B47B2E5D949DD4C 25A3882B0F1D113C C17CFD9673BA8616 291F24FDEA41FDC2 4252073A125F7825 77AB2A708E01CE9D 97826DFFE87C3B68 5526F8D8BB5F50B5 CD7F27B99C0DF051 2BAB71EFF0A2D1C5 2C6662B2D734C485 8A71FB52ECBF055F 6F8D2B8CC05FD574 A74EB69931491554 C36B7C5692F9DBD2 C9475A773459B1C3 A7DE7FB7539BDC09 64F17A1B8911F78B 0EB946720ABE8508 FF6D7686689ED8DF 0BF92C57FA043A25 3CB14919092CD606 3BE431523E9F90B2 023DC121F03FBF02 89D858A3BBB3235C 1C5B28E441A56E0C 357E025143E72AAE 4E78892574C72554 8A3F7F11AABFF8FC 0CF469C100791B91 861C36542017D11F A13211B807ECA7CD 2B12B81E12DE4133 3083CE485D92F8B4 8EF07203A4D35F5B 3951ACA1633F338F A9B4A32B83C83DFD D47B65FAB56FE491 D9F603527C6CD9C8 04B551F6DEC17447 3EF9B681D646FFF9 A57FEB3DBD90622F 8D60935772BD5CDC 4C6B1311F03E48C7 092D9E32EC6BB423 B5A508E89B6412E2 AA52EACAE63ED57A A2D5FE677AFCBE7D E8D126C822CC7C5F AC8ACE30B54691AE 240EC2AFD678CC51 FB252AAD9A0B9036 C83EDF9A678AFBDE 3AE63D3DBB543944 D51A6FECA27981BA 313B4AEFC005B723 C836D34C831FD5EB CC30000E42764B60 8D9E5E80ED6F2602 5A41694BE33E3F38 F62AAAA95179509B 45DB5CE3323A853E 06697D79CD36884E DA726D9FA7883CFB 093F27F6A380E3F8 49AFD7F41AFBECAE 597EC8B7ACB6AD7C
- Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9201210071445(name+title). Key = MD5(password) =1ae561966a97eb2cc315d09c61bd09bb, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).
Decrypted: GUID list
1 80a8b8be-ba88-2cf8-a723-b031fb8bf6d9 2 93967244-cd77-45b2-8866-dbcdf53197a2 3 cc2c5040-3f99-7da0-ba23-f3884140f8eb 4 7cc64a56-3bcd-5115-9e12-efbd51890edd 5 f77f5866-93d3-17fa-9453-e0a8a8d7db8f 6 896ed7d4-ff59-1f97-85f1-d6654ccf84d5 7 6dc754ab-5321-8a7b-b828-408e11578165 8 88b569c2-7cc4-3754-92f8-dcbb5e655c37 9 e74891e3-7af3-09f2-b4f0-1c81cd283072 10 e79c8dbe-c0af-0fd1-816c-7f7c9113c470 11 256324ee-d120-31e2-acd3-65546f7a8ac2 12 852fbff5-1c86-02df-8106-fb1a955d3745 13 65dc9fdc-8d48-2f95-9991-99e938b35447 14 fd42b637-4c4c-653f-860c-5a7aa7a95a73 15 77bec904-d277-5ef1-96d4-cba6a003d91c 16 9b673a17-eccc-4544-b02a-b0c19f1ab5e8 17 ed38d8fe-6d69-37cd-951c-55c8a1affe49 18 ab2b7cf5-d3ec-8153-8baa-efea967688c5 19 3c1c3a70-f916-7343-9644-636767de4928 20 fe02b9a7-d2bd-39bb-af28-6b058eea235c
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
24751183003026543873. Exactly this sequence comes out ofnew Random(558).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 392 of Run 35 (seed 854,622,578):
new Random(854622578), Next(8,64) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36). - Conclusion. Filler. The content is fully explained by the two RNGs.