201206260236 vmewa
explained decrypted manual
Operator test: 21 GUIDs, seed 149. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
17F738892B355489 C6940414BE19FDD7 19FA17953D5D772C 163331265F25FD14 1DD60157723EF0CB 7A482BB21DF2DDEB C296B3EBC6E59D76 1EA21BEFD29E886A 1C1CC03DD2CF4752 360601C43AD4F425 9C338877112ADA5A D234C6DAE00BC6E8 4795D359094F949E 4FE55A77BA30E315 E39EDCD9B893D811 F4523C6C61C51D16 995B6CEFBFC199E5 56308C3D748D7F83 DB0A36961B03C8C4 6E122641CEB8035B FAF9279D73EE08AF ED2BF796F4818AA6 0BC42BFACD1BFE8F ACF7EDDD0584325C 678280F23219FE43 900B62BB0BA00D79 348EC6187D64B7FA 67FBC3BCA287DB07 0AA6B23999878C95 754B36183F561206 22FEB9D369993154 2E629BC782C0F2B9 9B2CD18218E6BB6D DCF309F3EEF38595 F143AF6342345B0C F04241A8D130F8A7 6E950394D92A2846 399F8BE2A548F720 EC513999C335F45C AE8B2D5A83283871 1949DB645B8A3FA9 BBB1B4FA897F6326 C7EBD7A7C0F650CC E03A7CCE80234BF9 2C92D9C5C8840932 F6E0778965450924 B4603B9F4B1832BB 1A04139B1FB8CB93 2412C40E7F0DDD52 2684D74E7B5FC3AE AFFD3AD953ED92CE A0E8358E78E7C6B0 617C34FB2188532E F29FC58ED6A8E1CF 3A390ECC91C25DCA 16654C7ECBD756BB 690046E35F852C1F AF5623439184AF3B A6F4F165C76D05FE F4918A5399D98438 9556E3C7F5246049 256E7340CF93ACAF D8544C10C2931EF6 1AE3FAD886B5EA81 04CC36D5E17C5DBE 79153B7CBBB97FA0 5BAEA193EC5CF1C5 47F06238B4C4C05A 932B36E21E14CA84 EB94E32A562009E3 48238C8BE49CCDD3 6F1293A09394BE4D 05520245815B48B3 11D20A42235387A4 DA8F788741904721 AE9E35FF14315A30 C246449614BBBD13 731323418C821373 A6755A468C0DAB83 AE22B1E8015F0D06 9792C43BCFFAC312 AC5E01138DEF3EF9 A9CB96A0E3CC9A09 0156B61BA27E47FD 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).
Decrypted: GUID list
1 cebe67d4-db55-5a0b-bd11-8c4a06000538 2 5ff58d99-5228-4699-afc6-bbe8faf832ae 3 861787ac-e188-85a5-913e-312d1c10406e 4 9eef118c-f080-380c-bce4-5b59e777b07c 5 a2cb0646-42ce-4043-860f-4b5660453487 6 23c3f23b-5cca-6377-9381-0e5f71f5be55 7 2d1d7215-d033-5cdc-be8b-598c01670995 8 e73a87e5-cc17-1764-852b-a4af3da6a015 9 78e186ed-e8d5-3440-83b9-5f5ac97a26d8 10 f7ee0879-11f2-1301-ac4e-1a21dd39f44b 11 48f53a86-fd74-0094-8364-09e3523f532f 12 c4e4517c-2d56-7c4b-b753-c438cda08b8b 13 5307045b-f9e1-024d-b373-aa9609b507b7 14 27b966dd-a281-8eb9-89b8-3ce325b4ba28 15 a353ce9f-ac8f-2425-b529-63b28f4485b7 16 367f1ff5-e75d-0aa8-9c11-503afa3ec33c 17 9158e727-f0ca-47f4-9b58-92c599da0777 18 6f5b33b8-68d5-3ccf-8219-39634b6d5e24 19 08a95826-6faf-68aa-91aa-812964e17db0 20 dc87834f-a4fe-0b57-b6b2-e1ce61318dd8 21 f265738c-ccf1-52d6-85ca-ce55a1dd7688
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
548346513107082043605. Exactly this sequence comes out ofnew Random(149).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
- Conclusion. Filler. The content is fully explained by the two RNGs.
Solution summary
- Method
- MD5(name) ECB
- Result
- 3DES(name) ECB, 21 GUIDs, seed 149
- Explanation
- Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 149 from the GUID masks (3DES(name) ECB, 21 GUIDs, seed 149)