201206260122 vmcxn
explained decrypted manual
Operator test: 16 GUIDs, seed 173. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
69CDC9B0950173C0 E7888A36002F6974 B22CBF2BDE394CFA 25E40E6B6E82EA5E 00C737DACF79F7EC 1036BA10FD0C10B4 F877D21EA6A234E4 4845937AF9A38232 13044D07386C8779 D61373570E4A53FF 1B302AB2CAE810EE 20BB86EEBCF5F134 4623C39CE27C9156 D95B1E3D9AF89DC8 A4828E9921C56D88 FD26C5FA34D0C95C 3187EC33CC9DDF88 6FE91E7BFD54077B 9EEAF3D44DEAEF7A 36390CF3CD543FA0 90DC7860FC65EDBC E505FFA5E03B72D5 9B2977789DB4BC7D F3DF6B8CFE50AA00 F7CF83DC9FFB1DA4 6B8399884F066CE3 C405A1B4171D633C 61F294F05EACF5A8 1D02EE4F55C11409 B54691038AD7543D 6FD3DEF8DCD0FB3E 785337E985EA0EE3 B93745D2F8D175AA CD9D3D362F3B3D70 68686EAD9DDAB36A FE65A990B649A4A7 37784D63E39C12D5 C936128F4FA123ED 420E9E63C7FB646D FF327AB07D50F2DE DE38474C988A0E87 916ED9B83931CE44 58BAA2A117BADD7A D6FE4EF2834E0C88 BF55C77032422270 36EDE10E2A8BF0F9 5F06FCD335A52DBF 08FB93924FE92336 DF5BCC82C7A04E9F CC870B6F05C3DDC5 A2B2B20CBDB73FD1 E074A0AE07AFF3E7 37E88C2358351727 ABA51F0F6A4AA2F7 49F3E1C1B63F7877 EC8A0FF78DB7895E 02634933E2E55ACE 8320A40B296EC609 6BA250E1C1FD6CEF 633D24D16F726521 FD3AC6653E6E4ED9 75E162E58B7D162F 07A0EE7317734FDF BA4238BC7EFE6C34 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).
Decrypted: GUID list
1 ab1bd51d-2e18-033a-9aa4-c987d00c3a55 2 648be649-5f1f-530a-91e3-9fc6d2f02f37 3 5a1aec9e-31be-6174-9650-3f14f9cd68b4 4 0283bb0b-e3f8-45d1-9a8e-a73d0bc942c6 5 181bab81-df3c-2887-86c7-abbe41eb9d9d 6 b9f8d4a6-ff77-698c-9292-e495850597a7 7 c90d22d3-4a3c-3107-bd82-9582395e9961 8 9652f456-3502-26e0-9b52-84509a233140 9 26b28026-9876-3469-8d5c-71a791aef64e 10 a10b6e62-08a6-06a0-8930-00cbbc844176 11 78023926-7364-69d2-b61a-2a6d29c08ba7 12 6e24ba27-3386-44e9-9ec5-f538ffc99f64 13 a242b03c-9dfa-5eb3-8ec4-5a88bafe0989 14 718fb6c7-8492-45d2-94f5-02c5e13b677a 15 9c8c396a-8b2e-05eb-acec-d65308398b25 16 1d4ba86e-171a-0a06-a94f-e1459f3bc984
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
0564263230645400. Exactly this sequence comes out ofnew Random(173).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
- Conclusion. Filler. The content is fully explained by the two RNGs.
Solution summary
- Method
- MD5(name) ECB
- Result
- 3DES(name) ECB, 16 GUIDs, seed 173
- Explanation
- Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 173 from the GUID masks (3DES(name) ECB, 16 GUIDs, seed 173)