201206260223 vmejv
explained decrypted manual
Operator test: 22 GUIDs, seed 979. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
1CB7A44BCBC3AAB0 1D78FC144043FB98 FE1BBA1EA3AE4DAD 22CE2BD62FE4D8E8 E1EF4381E34800F9 7FCB5D8DE305CF9F 6A439AF2182A7973 670DC776B6E04614 8B1BD9958EAC16E6 9E52C82030796AF6 7D4DD99116C858B6 CE4E708505155875 1B020818C32C7E78 CDD9EDBF38A429BB 65938301D6815651 008B43FB04E86F8E 9F728A1C05135302 8DBD2E71B0D7466E F94EA14EE2947E32 DC44E3B61F4BCED9 5CAC93CC1CBE220F 6FCFAE3BD3B742D0 D4F6EAC52C7E37D1 0FC71566D9BAC6BA EF016DA7BD7814D2 A5F5FA333F116E6B 848936B6B46749B4 AA005EC46C7B0961 87F702D8F595931C B5E661CF130687E1 36F3394183AACFB4 991C2C2579837D75 003AE0C0284E51FB 1CD70A1DA8555CEF 460E77D3A98CF8A5 F769446B6381C58D 2AC4767B526C1347 A986297E25F179AE DCE83503569FF143 7CA3F5718C4D3961 8F43A21D9C77D9F2 A26C1068D39B42B4 461846A5755B39B2 6C4F3F104DDFDE70 43FAFD79D699DF0D 3ACA4D8A995B8657 A081F1EF4391D495 8EFA4786C107012B 7A7B7DF9428509DF FB8ABD4BD27F22A9 0438D7A9016DE277 781199C538BE5AE0 00089F33D81029AF 27CA1E7DE7E072A6 B83FF9399F055B40 8770D283E082D643 9FCB988B5854BABB A8589B5584F8BD24 A9FF1BF3EC6F2077 A6DC195809D82CD2 6529D2DDC24F61D9 B17DA027F4FA4451 47FEAEF50F1F3DCE 4292F7F69A87F613 5DA420465DEF7971 F8DAB919D65E2D9C E987E3A0F2B44399 659B1EDBE402DB38 1ACCB1B071F1AA89 09D3E60A96D01128 0146F46FE9AF2ACC BE84FBEB2CC8EBEB B246CD768EBD29D5 B0A6C39084AB18CD 90AEFB684D5E7355 418EFB2E9933A4BF FC35030C9A87C6E4 66BC47CB019E67EC DED4A7E8BC388EFD 324AB74728789E70 59C8018B938D94C9 45F3B71F18EE73EE 98BCF267C75694D2 F9C3D28CA87FA218 4AB3BBFF0CDE8EDA 518F92CED8B63928 64EE6B24E37A3A8C 38E0F3AA73666510 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).
Decrypted: GUID list
1 662c6a87-fe5b-1641-98df-96ae616d9380 2 156fae43-a955-0a85-b520-27b5de37970c 3 b55b7b94-0f8f-036f-9f0e-ef8c72d9d22f 4 1f55f199-baeb-432a-8d40-e941a2b20e9e 5 e24824b8-3050-1ce2-b480-74dd5c89e719 6 797e3075-a3a8-09c6-b4d7-5df56763276f 7 d8f6ca3e-7526-4ff8-b9b1-51c708aa4bca 8 fae6e0fe-99a1-5abe-81f9-20b08777308f 9 9bef77b4-e323-0c97-a273-a52fc1d8e052 10 07af5db0-6742-23d0-93d4-97c62021b488 11 d85569c7-e817-4d5c-8b47-58fa618c6858 12 2dfccb94-16cd-72c1-8140-b2ab42a3dace 13 786fb838-61e3-5b74-a5f9-f1ae3f068e33 14 15f4d9e7-def5-7afb-9f3c-e8524ceb1148 15 a9b6723b-0a7a-228d-a5fc-3dae83beb9a2 16 4c4a49e2-0614-3807-986c-7fe3e0c24246 17 7ee5891e-b9b2-390e-99d1-fafec706ca79 18 842c4fc9-354c-82d2-b56e-ff68e1e4a5eb 19 33d8b413-d27c-10aa-ab5e-ead087e669f3 20 772aa271-53f1-3e97-896b-73ceaafab9be 21 12099124-be60-8f2a-98af-c569cc38feb4 22 309a9aaf-c0c2-00ae-905a-1f2fd2cafe34
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
1004104502475723381380. Exactly this sequence comes out ofnew Random(979).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
- Conclusion. Filler. The content is fully explained by the two RNGs.
Solution summary
- Method
- MD5(name) ECB
- Result
- 3DES(name) ECB, 22 GUIDs, seed 979
- Explanation
- Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 979 from the GUID masks (3DES(name) ECB, 22 GUIDs, seed 979)