201206260119 vmcud
explained decrypted manual
Operator test: 20 GUIDs, seed 74. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
B1C8706BDAC36DED BC9F2A1651D3D544 F4DB0BB8CB6D2A04 918D83CCE69E9367 DDC14758C7C35F39 B1D004DE0711503D 8E646B6052ED4825 272727EB3D9E1B99 BD12E5328C6F2039 2E9FA0C08E316E05 2F7000B3F735DAF0 5DB9AC4D08C0A4F8 115F1AB86F2FA8D1 0666E2EB2EBAA267 74E8D749289D17ED 3177D5E5F203EC42 A829082632D28137 E4BC1A4654FF32A4 FC971A481BC286EB 5ABE27552F3CE555 E5BE3E4D34AC5023 EAA22B342DFAE98E 1A44A39AB84DCE70 9EA24C7341C2C466 D392E62320ED9B4E A85B7F527D022CF6 5CB33A9596B945CB CD1BBFC2A15DEDEC CB3AB8F9223A4F6D E5895F52A78C8701 F18EA8247A0A812C 48AA913853649F41 0095DA92677F8D9C 267CB4718E234C52 69763591DB02B8BD 05C3A1B229E78B8B 964D12549907FB91 78DC5836C378A72C 00D2E6C6B63D4460 ECCB6F70F34B4E5C 02028329C1316E69 59FF6E40A5F5B916 0A0366CA64C40777 A16B1219DC138B35 CABF7DC074848B04 4BE8AA2A34E41028 41E90596B0D823A9 B2524418CC689347 9F154C95C8BA5CCD E57CCE59A78BB6A6 C701938C72BCCB44 56250D0AF77842FD DF35455BC20DA6FC EB4FC547FFAE16F8 B19950B26C8FC9B5 4EF56B61E1804637 6BB0B0D4A588EC26 010B8288F0A0DAF9 5043E1FABDA2E5FA 75663E4107F32887 F8BDCA99BDD4BB77 AFB793D0D020A35F ABEFF395D559D68A 8D3C8B16736F80DF 65E5951639074759 A5E671A6F32426A9 2BC5B2D35F281E6D B0B7704AC4B7275F ABF378D80CEAA354 244D77B23E0F607B E6A837B1502376E6 18287808F35F6B8F 0A069FCAE20EC0B6 1554531BB9AABAE1 F78C56B485885A01 83BF9F33EAEDADA4 C8AA73845021642B 07E601840E5DED3F D94693EBA0C288CB DC4D85997EA0FC16 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).
Decrypted: GUID list
1 2cbd186f-598c-30f6-8eb2-ea1995ae6a5e 2 ec540c46-7c1e-4647-b0db-e85d5d2b3a3f 3 851097c8-ec7d-441d-a1fe-9871b7a2c640 4 f040b348-039f-30d6-8ab3-14b511862a74 5 5bbb7976-0a65-58fc-b75e-2d93b161b8a6 6 84938ba3-511f-28e1-a74b-ad69a0127feb 7 27e1142b-2e26-0fc5-9baf-591486294c14 8 c9ee5de7-a2fe-5027-8fde-e4763c03ebae 9 d9e39213-e2fe-1cb9-aad7-aa77507acdc5 10 6da4d9de-a4c1-5864-a701-3539ee508b72 11 9b0cb136-9498-7d2d-b8f3-d9cb22e31811 12 848f3dc4-1a2e-2b9a-9a7d-17089d95aa37 13 a249f508-95e7-4db1-8d16-46e0d8a4b2b2 14 65d0dc28-f73d-8257-be67-9b426fd05670 15 607d7b35-30cb-72bd-ab7e-0b27ca5e097c 16 9a619492-79be-2c3e-b0fb-2325f64bf421 17 3a39c055-3ab4-8035-85cc-94d7d56a666e 18 83dc8421-d732-7384-bab6-73e645ab8dce 19 c69f128e-3f1d-648a-9d4d-43446ac54377 20 ab9f4c5a-3f2e-82aa-9d48-21425f60c302
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
34435205157248728768. Exactly this sequence comes out ofnew Random(74).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
- Conclusion. Filler. The content is fully explained by the two RNGs.
Solution summary
- Method
- MD5(name) ECB
- Result
- 3DES(name) ECB, 20 GUIDs, seed 74
- Explanation
- Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 74 from the GUID masks (3DES(name) ECB, 20 GUIDs, seed 74)