201206260158 vmdvy
explained decrypted manual
Operator test: 21 GUIDs, seed 970. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
93DA6E6CA4313792 CCF2F88E7C8B476E 0966E0A650B0639B DB9A72479E8A60B5 BA02E4E4B1E5448E 2F0D7B5E6DA86BC0 35191BF1D2C2ACAF B90A76127278898C 41E0719976F56A98 FE042CBC42A61894 E0B01D390F9A8014 AA88CEB769B8A5F9 E0A051DDA5CCCCC0 1565C27593ABCB84 736B911B1F550CF3 8247934F3CD8BC5B 590084ACA5E60092 9069B5F15B27AD59 685AB3D287310A14 BA81A47690F8BCAF 3FC2A3B93C5BA558 E61C165B741611AF 75B781D5D3AC2E45 1624E500B7593197 2E7F9408B3CEC5EE 6136E64E30ADF880 5AAACFA163C69FB3 68494F1BD72398C3 D175A19C2395641C 824D1B8DEB3EF741 55E2F847BC00FFC7 2B3A32516515446E 185125EC54B12408 AF15B21F3103D987 1F4BBE83D7D6466C D8C9596E260687E8 B991077889377B32 AB20F5693F61203C E935E12D261434AB F7CDDC5B99FF778E 341BDB7F29506ED4 37E440ECF06AA322 E8FB890B5A7AD6EE C394E71C6C11A453 1D31C929C35D748D 7BF8664D2A830760 6B3DDFDD3BBEDECF 5A4F80BEAD554E0A 6315A126E62AC90E 0BE5348B6740DE88 544518103C285565 D49023491EE252A7 875B314476301E78 7BFC9E5D5B187583 5A3C1D5719A2F121 AA1700C7CB8AF1BA 97EE23E52AD623F5 7292006806B569A1 A1D0AD1A9FFE0CCC 55EFEA10D0FDED43 60BAC6D73BDB54FC E35AFDBA11C6BC57 C4EA337BA8722212 FF88CFF7B19CD251 63855AF241A5BAD3 6AC0BB5EB5B2B1AA F989A5AD2BF1ED2B CF0F6EBBBCE40AD2 9586A2B007EB7199 5DFB863E56D443A6 EEA9D6C4D9C5B9AD 9201EB02B09042FE 749EEEAFF2D2A602 9F058525B0595CA1 C4121D4FA3D4F0CE 5D732E0F4DAE5852 90E98160BCC5B09F 6BC76F855B894661 C46DBD9684AD14E4 57DD8A8154BD1E23 D1A40216454B2FD0 5C83D536AF86424D B754C645CEB55EFB B59C20E3D24160F6 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).
Decrypted: GUID list
1 3d5593bb-2c8d-4346-b9b0-bba0426c4e55 2 db6f97e9-4c96-3446-b18b-b35589d21b53 3 b554b86f-3007-755f-9476-9400ed1ec5a9 4 5fe25d52-c5c6-552f-bd41-9a09f89989b6 5 b9ee388c-4c1e-10b0-a59c-dfcc310c3e3f 6 5a4d3f66-e17d-233d-8706-6718b6de4137 7 ad84e810-6c35-4ec2-90cc-6756d2554f40 8 e69bae9a-be8a-0197-a6d2-6b5273d48737 9 f774cc69-449c-837e-bf80-285f5f5b2d09 10 cfafa5f6-ff4a-8181-83e6-99f120b3134b 11 df73f5b8-0780-813b-8f4b-423d465f07ee 12 628f150a-c974-6956-888c-18dd506f4420 13 b77e0da3-c741-4e2c-847b-f74684a7cd9e 14 498a642a-c7b2-1e7b-a4eb-0fe13cc2f9e4 15 d125eb6e-6d9c-860a-9f70-023fdea26a9a 16 a71d7a27-48b8-72c1-83fc-91fa58e0c99c 17 dacbba8e-9a69-5dcb-a1b6-af1b580ee92b 18 c3879594-f5ac-3647-9426-b8b73d37db87 19 fc75518c-7208-8edb-8571-a4cf63cd8f4a 20 df87acfd-f16d-8fb9-936f-c91c3dd88c42 21 6f8a379e-1535-6cc2-8ceb-79b49a84ccd8
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
437512408886418753886. Exactly this sequence comes out ofnew Random(970).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
- Conclusion. Filler. The content is fully explained by the two RNGs.
Solution summary
- Method
- MD5(name) ECB
- Result
- 3DES(name) ECB, 21 GUIDs, seed 970
- Explanation
- Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 970 from the GUID masks (3DES(name) ECB, 21 GUIDs, seed 970)