201206261103 vn1zm
explained decrypted filler
3DES(name) ECB, 20 GUIDs, seed 546
From the post to its content
As posted (encrypted)
DAD1093AD3BCE134 7EE173F9009E0125 241F2D520EF2136B C880C76DD619BCD9 133BAC66DAB81E0B 900510F2421EC7C1 898F94D1A315A265 D29869472BD571CC 480F134EA2635DDD 915A2EE00827CFEF 090C5F9961F34435 71F1CF7F5042DB6A DE7739260FD26495 A8CBD5AA1A3749D1 E5DB711F3DAF5233 CCE78E88ED2E0E90 018BDA3F525D92B3 4DA325068C6D4F2E D9B4E932B04E1468 4270A80DFD0F8972 BDFA7AE2C0F0349A 3DA539F993FB3768 4B18D1DE0ACF738C 31B421F2F0E0FF7E 11B37A2142143625 D842753695D7DE7B BA33649957501CFA 13DB5A561F963407 5634FA9A7A2327FA 5F13F29BF07FC0FA CF2B3661ECCAD1FA 57155A78B7139DA2 D6BA6AEA47B0C7A6 E16B5BAC54448690 258E20532C7B0004 F9CD472663B6D583 12D99C46B8DF8183 0D2F718F0255ADE5 067B6DEAECDA90E1 686A19B738917076 5D758D9565DCBE76 2E2FFC7D60A78003 C06A09B0D91BAB98 A5E8F2E504446FE3 34BD46A76E469F66 05890D2DA68459D6 A3DB345205C912DA 4E660376EE377AEA 284891EABF727A45 8B82EFDC644EF818 54B759DE3DC01E7B 17F7CD78C13FFD22 E63ED71AD0AAD7C9 413688F4BD055616 A224E2B743C7153E 2E2DDDB6149FEC87 18B1CC99254FB975 0C90E4E7F74B51F2 798ABC2794DFD990 FCFDD4E30AE371FE 16305753664AFECC 8D544723A660391C 02C7C827C8ED7B91 4C093FFE7ADFF3A3 D0C3AF67FA3E7BB2 BE63B9CB28797829 DF5C66B613875AEA 693CEDC70A8DAF64 19A80605DD5A0356 9C7ED7B2E091C0A4 67D100F8F89D6342 C4D9D162E8A5407D F94A6277CFE9EC2D 8386D478E17922D9 6BD73D1773089B2D 9A5A7EFF08E7F561 34EB32D5BE2FBC28 D5A808DE5D4D0BD4 CA568B7C255B5128 46016AE6690C4DA2 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).
Decrypted: GUID list
1 af722ba4-4377-80a2-b13d-1e1f67327a44 2 23e84f24-eb47-04d3-9a1f-ebffe42bc85a 3 0562978a-abbf-3a78-a188-4bd5414685f9 4 4052c26e-a130-0960-bde3-3698b9a27ea2 5 0fdd5918-c1d8-6589-862c-481224b4eca3 6 a4f5dab8-f1b0-6955-ade5-f6ca68917280 7 a111362a-7d00-41a5-986c-2547230e8016 8 d4d0ab11-ac86-3478-8da4-139fe00f333e 9 7e1bc770-63ff-4d2b-a0af-41649bd1bc1b 10 bc95dfa9-bf1a-5223-81ea-61b03a12e217 11 1ab273ad-a8ec-4655-8e1d-438e943f8ba6 12 c82d1ffc-247e-68a0-8e8a-b2d6815437b2 13 f6f9869b-e37c-8bf8-bcf8-609409ac9e50 14 19933898-5dc7-47a2-9d6e-2ba28e9debda 15 eb47f76e-72a6-1f23-906e-a747337119b2 16 b63ac374-952a-017f-85c9-9fb4e888da35 17 0fa600ed-3053-3c9c-b892-4ce2fd786c23 18 335ede4b-81c4-4829-9853-2474852fe5d8 19 e85f3259-4dbf-4266-9c41-9a212e51879c 20 5d733bb4-b724-6b0d-abca-ae62b22dcd31
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
80306643454684103446. Exactly this sequence comes out ofnew Random(546).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 13 of Run 3 (seed 1,063,142,882):
new Random(1063142882), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26). - Conclusion. Filler. The content is fully explained by the two RNGs.