201206260145 vmdjr
explained decrypted manual
Operator test: 17 GUIDs, seed 582. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
AA76E040698E80D1 8FAD5CC78E0DE3B6 449061B68E3BA6DB 1D67C44477E34A3D E8C7758537BEB383 4FA0A9C0DDC52E88 AD58581E11C04787 848D31E27BCA14B8 81F49D0EBF4AAB99 0CA936492D4F6A58 0242DE3AC573C97E 01156BB5AFF910B3 2AC74E597060A557 9E6166420BE4ACA4 897FF66D8982B28A AE9F04F41E2A772A 98302EBAC894E1D2 84F089598BDFDC88 0AF7D8C62FDC546A C1B54AEA1E607C01 625D85F8750EE896 0C7E5A2E04CC2423 F5ED66E9BFEE3510 C5CE5ADDAA99BCBC 9B19050BD2727F4E EA60B69AB3F40CC8 D0D7B57341D5915B 72931980F38366F1 D9F22F55E7181967 EEB9AEADC523944B 2E988485C56E4664 392D99CFCA9C0478 F6F83DB1FCBC930C 67C0C99BA607CC2D 511F6705E339EBA2 D76588148AE0582C 55C5C96DE7115F8B 31A598CCDB0EE4C9 6362B5478AE68621 335A147E587A852C C8DBE9D02D81D10D C49C3B0405495DDB 468F67A525FBA79E 4DCCE4D9FFB14022 8120AFE73B2D36B5 9C4217918E76BB40 D1E237FA1899582C 7AE6648CACF0E655 AF243773508A778D 5FBB0DD83A38E357 5A5BF89A47C45370 B5E9A8ABC3D15E4B 82963CF0A70DB86D 5407D13130D661EE 5EACB142A8AD6980 FAD06B75A4E6BA63 506F264739B4D0C8 8D35F4C111DA0358 EE9ADA9C390045FB A239391067182BEC 9C2F15A6791558B7 E368B759FAA4C6FF 36CFE66CED7C2A03 0859DA30001E247A 01F41A9A919C9F87 50A9217AE90E557C F32ABA2BAEA523EF C00BE0A3019C029A 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).
Decrypted: GUID list
1 eee5595c-7d60-673c-b9f2-62fb85dde971 2 a983b667-4f25-5997-bd5c-0c8012855e17 3 5c449d57-7964-5690-b03a-b2c60455d31c 4 0cf0a4ef-3dce-722c-9364-442cdcf9d48e 5 a5f6fbba-de08-8360-8156-df1c820eaa7c 6 e672d964-1f25-10b5-891d-b641bc4096d0 7 ad7b5691-75cf-6d52-baff-8b1bc6ac33b5 8 1ddb03d3-5ad2-3b76-94fe-44fb61271187 9 f785ffa0-950d-85f7-a6b0-e892af4781a1 10 85166fc5-88da-74f3-a23b-059b678daf10 11 39c343de-8842-0a32-a693-4a230676ab46 12 87186575-46fc-7c8b-9c7a-d3bc6660da33 13 07ef5484-58d3-6279-a268-214188f56585 14 c5b405e1-26c9-22ab-b9a4-6dd03fedb87f 15 17061d56-4e63-3e1f-81c3-11c6af81f42b 16 93f4156c-86d5-483d-9335-6b1ca9c2470b 17 97c998ff-6ff0-4363-9dc1-786228bdbbf2
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
65578163870762344. Exactly this sequence comes out ofnew Random(582).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
- Conclusion. Filler. The content is fully explained by the two RNGs.
Solution summary
- Method
- MD5(name) ECB
- Result
- 3DES(name) ECB, 17 GUIDs, seed 582
- Explanation
- Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 582 from the GUID masks (3DES(name) ECB, 17 GUIDs, seed 582)