201206181648 v8pjw
explained decrypted manual
Pre-automation masked GUID list: 16 GUIDs, seed 31. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
EFD445FE740F4AAB BDF1FF22E9D1A535 A4B22CFB94298997 810694042A0AA085 112EA3DFA7A48510 872CAEE4C5FEE02D 2EC0E13D4C25F615 2857CEF02DC05464 2EFC06D2E36344BE 175FDD0AF93DEFA9 26DEE8453F1660BB 8AB856A9885F4004 CBD9DCFF659727C9 34C46AFAFA6CD7CF 58079AB6183DFAEB 3968FB464E1A9A7A 26CBE47102AAC2E9 9BF6697E5C18C31E 066046492CEC5959 F5D3E286A7EB17AA 85DF744F21B26D04 8E987765929423C5 A89F0D4A6CB57B17 D32E9058C2D52B5D 2841FDE98B71DEB4 809A6F332DD447CE 13E2EF1F05DA3827 F0FA0C508D4709D2 2A2AEF011BCA52A1 5A1DA642FA182D90 98ED988E5F26CF42 E3002A66CD0C7193 14A4F7458CA96185 3CFEB34D5C9946E9 81832D01FBA603D0 595115C35FC2BB6E 2E047C061ED9B627 DF5A76EC4FCF2E9B 12A7C621E153464C 74CE6EF3770A2490 39FB8DCD7DD65985 22B6C5B263625179 CB28B762064829A7 821B4D7555A6A6F0 13786A2163FA380C C2D309D15BA3362C 89FE821B24C9C067 CC274279EFB044B9 AD3434FA591C80AA 820980AC636D85FB 30478184EEB9FBCE A59DF3DFAB067EA3 814C75A13964D4C1 4C0463EFDD340637 47D2E74501F09DE6 08ACBD6943F88D1A 3877B3C7476DA905 8D2649ADBB8757EF B3E411B95ED23771 BBC238C8A06060BB 0BD475C7A129F997 3D0B349C9E800932 AC1A0A9195273136 18CF373B06E08A82 0E968299F2558476 BBF58279123D399A D6447C424155CE4D 729A72D73E613787 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).
Decrypted: GUID list
1 294e9768-a64d-8c90-9b93-56d5c6924785 2 d4a1dcd9-59a5-8a54-9bdb-e3c3f7e2d6b5 3 c16bd478-f209-3499-8147-2dd07f6c1c0e 4 ad1fc0c5-faba-1603-9032-b52dab00e791 5 b436c624-1e31-10f9-8ce6-c54f14eae033 6 f63f4976-fc4e-5682-b3bd-8a74958921eb 7 f9c772e8-08a9-7a19-b9f9-8869c9e32bc7 8 35f9f110-3f62-8133-a7ff-d3056332a907 9 207d00ca-9db0-7667-b59f-cf2fb755c1d0 10 8642cf0b-b508-685e-84fb-7840c0558fb2 11 f621934f-33d9-1b1f-8489-fad0bbc85a5a 12 9c394fb8-10bb-6149-9076-241cbeaecfb3 13 5ab902bd-a22b-8dec-a23f-00a16c80de6a 14 158c7422-7390-5c7d-84c4-6e67d61c8558 15 90a894db-42f3-6c01-a7fb-e920cbda85b8 16 5a07c104-160e-38e9-b312-fdd467cadd2e
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
8831157876168563. Exactly this sequence comes out ofnew Random(31).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. Grouped in Before the scheduler: before the scheduled app (Jun 26 2012): sparse single tool runs / hand lists (o5o4o, jbucr, jkuyr), 2011 genuine-v4 lists; no long-lived count stream to fit
- Conclusion. Filler. The content is fully explained by the two RNGs.
Solution summary
- Method
- MD5(name) ECB
- Result
- 3DES(name) ECB, 16 GUIDs, seed 31
- Explanation
- Pre-cutover filler under MD5(name) ECB; before the scheduled app (Jun 26 2012): sparse single tool runs / hand lists (o5o4o, jbucr, jkuyr), 2011 genuine-v4 lists; no long-lived count stream to fit; list seed 31 from the GUID masks (3DES(name) ECB, 16 GUIDs, seed 31)