201206260151 vmdq9
explained decrypted manual
Operator test: 16 GUIDs, seed 741. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
E7609F0295B051D2 3161AAC75A1EF809 890FDA32D76D6706 9C59F100B6ECC24E 01C1629CE9CCD46B 1AC7B89529AD55BC D596656AFBCEAFE8 3BC18ADBD6F6A979 53791972918B1468 C0D90A3E7D0C287D 5039619F1A5D73E6 1052D485D95698F0 460F797EA55703E5 DC3939C8FC2CD6CD 5E20918B93C89118 C9621537A3FD59ED 94CE3753E286FDA1 E2E298FCF6E7FDF9 70C325206CCCB5C0 7B93CA62932B6167 BF48C735185F2D70 452AC503D34D2B8A A3B0B14AD5897FDA 05CF35D373B71B47 5BCD4B247265D2F1 9DE69E7D459E9F43 5F32466315D12A9A F6C1424B6C14FCD5 C7F65D48CD35ADE6 EC09DAF5ED38E3DA F4061627832A2C46 624478AF9FEE9A31 20ADDD8FAF7FAFEB A87218AF3466351A 3DAFE2C30D91E0F5 688AE6B896CF5958 D4B01C1B40D8E01F B70E8CFA67DAF3A8 D96DE5F63B44DBDA B3F732EE4552847E 19D4BA8C7F31A586 A13823A7963B2ACB 796936858765FFD8 E4A2CAB42084ED20 7A74591185AB0BCD 5BAFF98F85E3BE0B D38A5C09B9421207 EC4D9B159E49EE29 A8B3EE148799F7C5 D45BA3B60F04DEE2 FD7075CFC80486C3 E97FD7A50A05F1DA 8FCC25FAE557BEF5 7CAFB483D7A0FB55 DCE96D9367BCAA79 41529C45AA280369 CDC0604F0EE325E1 A632773D3D5C48EF 2D29D1751CDCF4F7 E1AEB5B06AB8DE2D 622E26D8D424D3E7 1CCA3BAF3ED35220 D395176500A848AD D11C2BBEBAC2AC1E 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).
Decrypted: GUID list
1 2b4ed62b-f476-7d2d-b965-01d3bf7edeb3 2 806281fb-83f4-26b8-b2ac-990be3164b07 3 3b13973e-2206-6b0a-97b8-7200a432ef5d 4 34136703-2b12-6559-82a5-a6872951910e 5 a4b07391-8ada-6628-9bb2-b1905523e20a 6 25cb5994-f31f-1e37-a41e-b08ef2769d9b 7 f71b043d-6dd1-842d-a966-6e9ae5902562 8 d4cc30c3-24c2-15d6-ab2f-c5a4c9111dfc 9 9910cf73-3708-5d67-ad55-fe4a27fb653c 10 43626cb1-aaf0-494a-9933-fd648df48ae8 11 b8e44a22-8aa0-1b7b-afd8-56787693e822 12 3d3d0c68-f551-8b5c-ba22-a94b86433415 13 0ed3aaeb-4fc4-0324-a2c1-cc0821b4f84c 14 a799e930-af18-831b-a70c-028f771ca7ce 15 d4975c7c-466a-5a0a-87ef-cd224205c6c8 16 58abf8d0-25cb-791e-be4e-ecb20c1474bf
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
7266618154180857. Exactly this sequence comes out ofnew Random(741).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
- Conclusion. Filler. The content is fully explained by the two RNGs.
Solution summary
- Method
- MD5(name) ECB
- Result
- 3DES(name) ECB, 16 GUIDs, seed 741
- Explanation
- Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 741 from the GUID masks (3DES(name) ECB, 16 GUIDs, seed 741)