201206260046 vmbv5
explained decrypted manual
Operator test: 21 GUIDs, seed 850. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
27212325955B159F B6E247DF9DE7E658 58FFBF33B1E8943F 42ED454007AD3392 EB270B3E2F73CBF3 1C35DC0C93F66174 ABA0B138153F631C 4BCAB319ADFD6C01 A50BE30B11EA0DD2 9A18F11A2C3666D8 CBFC05F5215BBCC2 CADFAD16331B6E97 C060D019ACFF1903 2024D5B398BED2EF 09CA133BECF56528 5CCA6EA1051E7293 D41C9235DA0036E3 650B3F2910040AB6 63633B871180C9CA F74B952A2EEE9A78 1C1DD522CC40AD78 575C2F27C2C9FFD3 E121143DF63E7857 325FEE2BAECD58AC A1C16390ED4AA23A EEB729C0380808C7 5718B29C005C530B CADD98AA1293E995 92EC4DB76A0E9EC6 67FAE75E4F8D013B C636DB21479DE28C 855CC887A5F09044 908FDD83DA4B7E4C 988C58E4F2DB5CB2 8AFEC18C5297D8F4 77B3105B5CC40548 9F2F219209DB6CB5 3FE3B29CFC6F0AF7 7D888D485A02A589 DFCDDC1C2007DBD2 50714E6C2229F11A 7A09A291AC0F8B88 B015B5DBC69BE74A BA4F0B3E90104A0D C2E1A364D6428A4F C8B96D41C5DA269D 790F28DC81AFB3A0 5A586654E661314B EFEDC5C2A32EAD0F 58C077B32B845F17 49213CF3FDAB0E86 16324ACFB8114DAC 289ACE867430B420 D4983505166E2AD7 C248436B85DDDA1E 943F9B2770ADAF79 C86A9D1C8F28086B B45EB0882F7D07A5 6056F10B35B689E6 9740042BE032182A 8DE061F45E377917 8A66BD3C9A4DEE1B 30CA2D45B5FB235B D26349F3212E03EA B803E1D5C7FED67B 70211E9D7DB5D0F5 96AB6D6D5D0A86FA 7B56CAC0C1FB326A C742DA906C6263FA EC7577C705A904F6 7ECE5B33A6B9E4EA 88F713CA7D6BD76B 2BDD2455327E9E8A 2D375DA772B236DC F927CD0793047614 273579368E0DCC13 023C777452EA2F92 8D4295896F6162EE 3AF2A24F336E3909 B8E6BBD92F6B94EF E4816D7D5A5D4899 D21564A57EC4897B C2EFA9351F6388CF 266D4DF43C4B7B8A 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).
Decrypted: GUID list
1 6efcc226-8f32-77aa-ae8b-6a5f50e2127e 2 8bce9567-59e1-2a5c-abcb-948a5d2d898b 3 8dbbb3f4-a5bc-8312-ac6d-659034f0407d 4 033167a5-d63b-80ea-9cb5-5afbf62ff792 5 aee1a8c5-a2f0-8332-8447-1eeb9d460e0f 6 4a55560c-04e9-30a5-83ac-138592ca21a7 7 356a4fe2-5f13-6c1a-8b26-c6fce2be6c90 8 d00cc6e5-f516-7910-a25d-4807f23fde33 9 2ce4d3cc-daad-1298-bd27-6dca157fba21 10 8c0ff0ac-6b61-6b63-8799-87dce5e3d884 11 e153d434-ad2c-470d-8a65-cee2525e8638 12 d9c82455-ce86-011a-af03-82d2c1e35c60 13 fba24260-2251-8a6b-8de5-8be82a6a4fc0 14 958c50e7-2291-649c-be83-258a6c478dd2 15 d40b3ac4-78a4-856e-ab47-1f1c7a8f9415 16 01cf3bc0-0bb2-7c42-b122-22d1a730b96e 17 153724c2-48b3-1134-b43a-ca2fb2e3f6bc 18 ad6c0587-c138-8b97-abce-4bf7bd9ecb29 19 79f5d593-1f77-6bd3-882b-c43a5da5ae47 20 6f135a5f-3645-3b60-a423-53a508afaade 21 90222272-9db9-6b09-b0be-81a518a13e0a
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
728883671640868718636. Exactly this sequence comes out ofnew Random(850).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
- Conclusion. Filler. The content is fully explained by the two RNGs.
Solution summary
- Method
- MD5(name) ECB
- Result
- 3DES(name) ECB, 21 GUIDs, seed 850
- Explanation
- Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 850 from the GUID masks (3DES(name) ECB, 21 GUIDs, seed 850)