201206260042 vmbr3
explained decrypted manual
Operator test: 20 GUIDs, seed 996. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
B29D5B002C82D2CB C715C4118F689A7F C43671CBD9CDDD77 7518BFC68371C856 65B08DD3B84F88AE 2DB6CDE80FB979ED A215997A7F0B63D8 31FC505267CE478D 518EA1A0EC950983 AC38AA55EF5478B5 EEB7DD8095661031 C8E44DAFFC85EDAB 0A7EBC7D9A6B8AC8 651D7ED2BEF7283D 691FF2125ADF4857 F512BEB27DF1B54D 034E7EFC7507E1F3 96557584048732BE BDF0DB2150752A9D 098564F6E6DBD1D3 42EC5115A1B3FB77 BE1A70123201824A 7269DB97692FA1EB F21FDA7463C88D37 08173731B3F5A1B2 B3449F484FBBC414 591CBF349CBD5ACA D334ACC226ECE1A4 086A4AB623408176 C06CF9EECD55ED1F C577D5673D546E1E 8FD2E5C070DDA4FA 131B8EE12CCA2408 CFF9639ABF5EC8FB EE09E94C4913042D CF64CBDFDCE0246C 1F5FF5DA034E9C3D 2A293C523C4CE8EE 15B18B18AF9BCD6E D28BEAE2D8521B3B 6D9BF4E87FCF41FA B7EA1E128680B417 AB006D02189D534D 0982274F0BC8AC75 BB15751A9A6ACF09 07997D61F10BE07F 482DBB126D56EACC E54E36F2A68639E5 499631680AB554D4 BE9AD9E2C8F1AAF7 8AF1604995280834 F8D1086CF5BE960E E466FBA62AF7BE39 41535C52DDF2E8B4 1B13AFFCD723FA4A C9B052E79728E0F1 70A9F516D87E544A 27FBBCD7BE3038AE 7BD1D38FFA877498 76E7CD4A7B19E2D3 9B460D91900E5991 26B0A450D24748B8 62C1CC5CACD71B49 53A4EB718BEF4D76 0BE229FE938566A1 FBB1B6E26DC0ED67 8A6B961E66FCAEF5 47F72BB9F0A09447 BCF82CBCD379F7D9 0DBDECDEF7231834 43BF4C114193A126 63DC1A9680D530E6 D07EE46E03FFF746 8853FE93B8AB6BFD 84DCC7CABF9D59DB BAD07A6276CD073E A365197202290B61 FFE8260355AFB20B 6FC162DCD8F84E67 D08D81F1D0FC7DAB 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).
Decrypted: GUID list
1 f5b59ea4-c7eb-0a2f-8085-58c56602ba44 2 0abbae3e-b90e-03d0-802d-c003849ae418 3 e4145953-fcbe-8a03-a31d-642645c26a2e 4 db71cb45-3415-11aa-bfa2-197cc49c3428 5 24ee0fe0-dc22-7721-ba36-67f661bc68a1 6 6ed1601e-065a-8f02-8542-663ce2580e89 7 627beb8d-aee2-1ada-84af-aaf25967ecea 8 08f86b85-4d2a-16c8-b0ba-505e1fb6c41c 9 88f053ad-30a7-1a2a-88f0-db00c2449d8a 10 fe26705c-56ad-4ec5-9c3c-44cfa7848a81 11 d4ee048c-7339-0fa9-9aa8-6fa1be25d1e1 12 5de49569-28dd-0e66-abfa-393614ef247b 13 e56c01da-6a75-3e0d-a64f-e5c877d3d885 14 9e111fae-94a5-529c-b15c-477587a641c8 15 704526f9-989f-10b7-925d-5e50c8a7078a 16 df50277a-d07d-06a0-a0c3-23c66e054b9a 17 ab430128-cafc-4d75-9a66-5f3fbe1d0bca 18 0260c436-922a-4ac0-bd78-d1aa7b2fb9d2 19 2996c601-26c8-5584-9037-58ab9610bb31 20 d40d3ba9-4a04-8ed9-866f-a751a7cb95c4
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
00817811140035104458. Exactly this sequence comes out ofnew Random(996).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
- Conclusion. Filler. The content is fully explained by the two RNGs.
Solution summary
- Method
- MD5(name) ECB
- Result
- 3DES(name) ECB, 20 GUIDs, seed 996
- Explanation
- Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 996 from the GUID masks (3DES(name) ECB, 20 GUIDs, seed 996)