201206260204 vme2c
explained decrypted manual
Operator test: 16 GUIDs, seed 954. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
07D1C1731BEA082C 70D2D6DE43104DD7 1C31D913B24BC27F 134C82A0A13D6ACA 270BA58A08432900 AFB9F7D8D7D9797B 529106585DE0843B F0D16A564B5C5149 F17393BF0243B634 F7451D4B6DCA25B4 A74D770ED5F9DA91 3612B81B254A219A 76ACF544A0A6AC6E AECB972D4F26BFBA 5976B707560ED28B 56C0F72FF9BD805F 23D910248A651244 6FE86FDD26A5276C 7D2CDE4D703060F2 FEF2121E4A552FFC B43062C324950734 D433DD3080E90C4F 921CEAE3B96D089C 36E4BAF5DA538F27 4A082BECDE9B8F87 B17ED51E143CA212 CBB719BC11987A56 B10CB68B8944E5BE D4CABB3E3A702368 D4614F0B8410F61D DEDAEDBCEE71BE9C 4083A5672E576FAB C6CEC3A45638714B A0C7DEE17CDC1206 1C2AC6216958F949 1E858BB6DD9020BC 0779FC1F63CE89D3 278A6FECBC118C77 1667FC2DE3A32C7B 2DAEBC4562720D5C AAB4670BE4E3525C B29A0A232F56A173 13D4BF3808207E54 27EC158F80F1FA63 381AD7E68E31B3ED 2B4719385972D7DC 7BC108886CE7396C C554206428CB3B8B E50E67FA17DC29FC 6E94F88F42F70090 3B6044AC031A2994 C5177627D5EA5A90 F63144AE19D9817C 514668A66C03A923 406ABB1C9E689A0D B73E63403D6A7E79 78EAD6BF8688CF63 00A3885AAE07F19C 594D6D2F5207E099 21A46CF9EC882FC9 A0D766F339F33D4A F89F1E379DC1CB7A DD0E4502A25E3F9A 62A0764B002EB6DB 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).
Decrypted: GUID list
1 592d4b0c-0a43-1a33-9566-2705fe42c8fc 2 42d7160e-395b-6e47-a4ef-f6e4f1eb59cb 3 e4f6099e-a35a-5c6b-be72-ca1c306d22ce 4 73206e84-5e2a-1cb0-a972-c4217395f712 5 2c22ca04-300d-8e28-bc02-5758b04527a3 6 b790230b-08a1-25ad-b087-6b7a30a3105e 7 7af23614-3752-312d-91c0-fa1852019608 8 9cb90b78-afa3-0b5b-bd43-a83ffade4cff 9 d741a207-c8d4-079a-bf4f-2a4fcb1e2806 10 cf88dd2d-e374-0699-b801-5b8d9fe8f093 11 b4658fd8-0f5f-1a68-a885-e6e3ee296111 12 1cc59581-8995-277c-8210-5b155a6c798a 13 80efe8dd-c018-483e-9b74-598da1cc77ab 14 a39741e6-6b80-7d25-a3ea-e26de4c71006 15 ec6a3c32-5e85-6912-839a-e32bb2b05ff1 16 260eff54-6495-7032-aacd-1fd62c30ad91
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
1651823000124767. Exactly this sequence comes out ofnew Random(954).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
- Conclusion. Filler. The content is fully explained by the two RNGs.
Solution summary
- Method
- MD5(name) ECB
- Result
- 3DES(name) ECB, 16 GUIDs, seed 954
- Explanation
- Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 954 from the GUID masks (3DES(name) ECB, 16 GUIDs, seed 954)