201206260210 vme8j
explained decrypted manual
Operator test: 16 GUIDs, seed 198. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
DAAEF69A0553C344 154CB77F627273FB AB38FB720ADCEF67 015DC09BD026DFCC 6E07474EDB6D1D48 37E9D1EC147CFB7C 1C4DC86DC9AC9B40 280A5F05116E892D 273BF65DFBEB37B4 D3034BEBCF2E0663 259A72BA0568FA79 CA525F2BBDC5D138 26A84E1BD98074E3 49CAB2096DA5091D A7C0FF019F17A8AB 5EF9C15A114DCE32 C69E9EC472F081E7 5E6711E527D35D3D FC3B68449D4C0E14 8606E1CFF481818B 6936D664AF855FA6 3616BCEFC681C791 5DEDC4495CE190FE 7AA208F19A32543D 18C19A05A0424E88 43F689BBC32B39B9 4368D6A3B7B1DFA4 12A5D9EA7D2A8D94 4DCB93A24528F355 64B123ABCE04F430 157EBDB5BC6E5B95 798542A949BAEE07 A910E27FC01F2C67 F192A33AC9C9D0DD AF146858F02A4D1B 0EED2469132F1CF2 EF914075B939E7D8 98C7C4B9D4273C2C A4FE5FB2C053D03B 9EADC18F42D3D7AF E1A30845A52DF0EB 9EF83739332DFA8C AF5468C3C0EA8EC6 372EED6D40FD4EA3 C0C08D46D3B2D810 61434ECE8EA05DD0 2F317808EA948DCC B940F8FE3D260586 AF4055B7838EBA6C B96B1AF725FFCC44 1ACC8F57B8C4E36D 9855E2362594AC69 405A797ECEC4DD71 2750ACDCB363F586 C99989A565320B87 E22C83485937DE60 7B0226F254D54949 B7331A772E342694 D65A0D6356079010 829F53D14BF53E7F 25AD3DB844A8B1F5 E595141B2A378BBC C7D8FF2511F9C276 64C571F6281E49D2 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).
Decrypted: GUID list
1 e385f556-ded2-1133-8452-d1b65e730d56 2 3a3f6d7f-3611-8bd8-84e8-6f15d91734d5 3 0e01939c-562e-1b45-82eb-1af547309f18 4 ffdd885a-5bae-7ab7-9fd4-19be3aab87f6 5 087cab42-7f6e-5997-b89b-ee47519038ee 6 be794b1f-19ff-576d-935c-a895ee79f974 7 fc9bbaf5-b77b-57f2-9e6e-4f7d2ab2f6cf 8 24b522ac-9fa7-6707-befe-28024a8cbee5 9 28aa7406-cf42-49cb-a6e5-7107b853f1f2 10 901cf0a8-0d2e-28a9-9210-30eed8abbcf8 11 006b8d35-1025-1049-be04-0922d2807d81 12 00293beb-604a-0d86-9f64-3d60520cfb34 13 34bea399-7b15-69f0-a18f-7ebe8202b74e 14 09093779-87af-40c5-905b-0154add32e4d 15 841011c9-8bf6-55c2-aa99-fec5219c7e5a 16 5083f3f1-4e74-62d0-b681-3a8005c17bcc
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
1817555642106456. Exactly this sequence comes out ofnew Random(198).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
- Conclusion. Filler. The content is fully explained by the two RNGs.
Solution summary
- Method
- MD5(name) ECB
- Result
- 3DES(name) ECB, 16 GUIDs, seed 198
- Explanation
- Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 198 from the GUID masks (3DES(name) ECB, 16 GUIDs, seed 198)