201206260053 vmc33
explained decrypted manual
Operator test: 16 GUIDs, seed 386. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
10E4019ED13DE551 4BF805E3FA4831EA 5D810D1FE6D2FC42 D86A4B77D4E538CC 2BDD850E0F360ED6 6E0C41725F75C78E 12DA70EFB5E1E155 156FA00D2754D316 C77EE3C033185B61 99038A60277B7648 470F0600449DEF54 AC46738F9F642599 BC4A73BA4CB5BB77 B9621C8D377633AE 26C0C0810B814079 3F7B48456CBE3F18 924635DB3C127BC1 9C39CF8CF9CA28C5 7E8E4B69739F52AA 08E54BA437BC70DE 358FC7A7B00C3D11 15E8F13D814F974A 1022B7C60C2E5B6C E2804236FC6F0069 86BE5ECCB0C64E6B CFDF3114A22C7CE7 1EB63EA913C9D46B 4957BD47E14480D1 EAC098CACECF69D4 0635276AD2FAA1C9 3F6DF8DAFBF70D57 CC316822BCF08B0D F8942D065C54EA57 861846F3DEE12763 4DBAEF8D2A06867B 324F673FF4F55556 E1125427E91033D1 2FBB614E603EA66B 9822A48E45632B9D AF6E060E6F030BA5 4D06DAFB8EFEDFB7 B35C615E48A61534 E9582BD6BA138D0B D25C05B6D03CF194 4D4327CBDA3A6A0D A304B723B000CE6D E91A800F635C6A1B B854612FCAD9F53C B23CAB82CADF312B 184F279C46B93BDC 17B8B43A3E96AFCE 5791686CBF9F6755 46BE4CB46660ACE8 D4DD7BE6373E915A 8889065C81FF6A5E 042E58A2ABBCCB90 4ADC4014115A0DE6 2FF5B14E734518BD 360E37C2D685BDBD 126DEBE2FEA4E1D9 B27B9B9429D684DC 5E9AC24E25645A6B C59C6EE73D3D57DA 3431A9190B152B75 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).
Decrypted: GUID list
1 df004688-30db-357a-8210-7894439a695e 2 278b54ae-6043-0998-8f9f-4467a447a62e 3 b533df40-65a0-535b-9baa-4bf4b39add27 4 f5372a80-4ac7-83ea-97ae-02b825623b7a 5 373ae459-eaf1-4783-bad1-3b9dfbe74711 6 f7438f05-56ff-75d9-b286-a02d28c16eb9 7 eb3a5d05-ffdd-7494-8e81-f49a72b38612 8 00c57d29-a02c-0743-9e3d-c05ea32837cb 9 75f30ff9-8eb6-6ee8-a25b-a803a9addc87 10 be14beca-5d29-58fd-abc4-83207c79da93 11 e8bd7481-698e-6aa2-b18c-4565d810e205 12 5a2b72a1-df35-7c3a-b199-a1d9320e1e02 13 72465d2a-f9ac-85bd-acee-47952ef85d7c 14 8c364939-9650-24db-9428-7deb75a669c9 15 c55b1f21-17ba-1ae2-babb-11dfb4ccd997 16 fcff99b1-b86e-05b7-8d46-dc1037bca5bb
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
3058477065678210. Exactly this sequence comes out ofnew Random(386).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
- Conclusion. Filler. The content is fully explained by the two RNGs.
Solution summary
- Method
- MD5(name) ECB
- Result
- 3DES(name) ECB, 16 GUIDs, seed 386
- Explanation
- Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 386 from the GUID masks (3DES(name) ECB, 16 GUIDs, seed 386)