201206261059 vn1r0
explained decrypted filler
3DES(name) ECB, 19 GUIDs, seed 860
From the post to its content
As posted (encrypted)
46F5110FE45C9DE6 D2DDA17CFA4B2D17 9E279C2C345D8F95 22386004B6D453D7 6046A366E49FE1DD 2C8DFB2C2AF91F62 54428B1A68065258 F8D1969814D55139 8CFE914B48013606 4CA682C66097F56B 81760851C6F72974 BEAF2EA064D21BAF C63C2E7238E9F808 72488DE57B92314F 06F0C86FEC6D9801 66A1F9C2673AC87A 42F402AD5F522242 025915C84337012D EB5F54BA7C40C300 F349E7868F7B5A64 69ECE564CCE4F844 1152736C1586AF76 E69FB6DFF4EF7ADC A17FBF6123D4A938 479919AE8256DD33 62FE9CF9D531EAC3 F9D38EEF389E5D79 EEA1BAA063322274 BEE877D3692AED34 5357AEC64022CD44 57591818C3D4CEFD DB1CBA0189F48B10 7BC22C56BF94FE94 27D1696CCDE0A186 9B316C8F43459C7E BF15AC997D7AC2C2 8793062B460FB0F5 AF87D95364D607D5 2E14C383E0D1EA43 6924BCFD6F677329 DCEE17B5D23DE5ED 6439519B399003DE 7706CD5288E9D73D EB3E633B786940E6 1CADDAB5B71833F7 784EA92F6498CCA1 3B22969A5B4FE4B5 BA485DD44015740B AA5768114A834D14 B313DBF3F8A25120 0D06C816B1B03513 9F70D9C2B4877D69 63D466A08CFBCAF2 F54CFBA66614298A 7225CD988BB18FFC 9CC6B71F0777BBF5 E6545C649F7F5BB9 35C729FB138C52DD 7D61E06528CBB73B C6E2C39D73B701ED 184068A6C14CE976 80130A17EB1DE40E 324BD99DDD2D7CB7 B3E2232CC5EED2A0 904EEABA0FBDF7BF 52D6C2B23000194D 83F0D36B7EAC70AB 82326E668DC65241 E07ED2816E79CCFD 8E229E89979F6EDE 2F7B297B6FD98CE9 EAD445BF6D4F1165 9823FEA9D08019BF F6275E15207AB72F 09F450EAE2E8BCC2 0034A7FFDE655FC3 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,232 hex characters = 616 bytes = 77 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 19 GUIDs as hex (shown below).
Decrypted: GUID list
1 fd2fa64a-568a-0c9d-99ff-eb0e954c77fe 2 80bf945b-445d-1c10-9495-abe83cbbd008 3 a46d09e4-1a92-8cac-88da-7828c57ab338 4 c30fd07a-ad6d-1fa0-989e-d5f1331d56c8 5 1d4f69de-869e-42ed-8e21-1aafa047525d 6 2934ed40-0c69-0e4c-aa28-38c90b82bc6c 7 931d5e2e-d3e7-2ea9-bf78-6f6436bd9974 8 f540b7de-101e-8415-9ea1-edb068af2c04 9 f4498d0b-044b-3cbd-8cf3-c4bcc7ff52bc 10 cc9018a9-3982-3a55-bcdd-c5fac298655b 11 844f34e7-1a2c-7e31-9204-db246e27d91e 12 d610e15b-d7e4-7a37-9866-48cd88ab66b9 13 2ed94165-b1c1-7c2f-bf98-5b749759fdd6 14 7d48353c-87ad-8b13-ac61-51061392cb70 15 bb887c1a-794e-8f5e-bc31-67fd1dbca356 16 72736ae1-2b7e-1e3b-91ec-a1b6df5ae2f0 17 67ada7f5-66af-3b7f-8fb3-aff12ea8ac46 18 a051a470-96e6-153a-9cf4-49753bea4274 19 92139a9c-df32-8fb5-a5f9-afa38e5f5c93
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
0181402833777881318. Exactly this sequence comes out ofnew Random(860).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 11 of Run 3 (seed 1,063,142,882):
new Random(1063142882), Next(8,24) per post. The RNG predicts N = 19; the post has N = 19 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26). - Conclusion. Filler. The content is fully explained by the two RNGs.