201206261139 vn4gr
explained decrypted filler
3DES(name) ECB, 22 GUIDs, seed 971
From the post to its content
As posted (encrypted)
0D2963A0DB929ACF F87E2F2672D6A392 AEF0E0ECA2FF9FF6 C816584F7E971246 5EE31B08AAECFFC0 7BF769813E090F33 C7AF592190B6EBC3 E752830B8FFF35D8 87034DCB0B97C7F5 71362A92839C51D1 42E5F37EBA2CA906 ADA8D24D06612F3C 09600055525F5E69 39C6AEA382E0F9A7 23F6DBBF263ACB82 DB8FA721F1D29403 6B97A1A7AFBDDDB1 30492D1A1C874FA3 24AD2F2C50FE2CD9 7F5C75AC47DF6F4D 5E9CD76591AE7C73 DD0424FA55EE4FD9 62291054BB4361F9 496C8E22D120F431 DBE946A169C0FC3F 020A9A60CE5FC5CE A8B642037603F9D2 25405DE1F61E807A BECFEC9E9A5014A3 97027C7D2A0D72DB 85DBBEC12D71C7C5 3DE56A6BB8AB92C4 C33713F7731C1C33 737FCB1F088FAA1F 394D2B4B6494DACB 24156EBC690C1128 4C36710646638330 950A3C3C48649F68 1A7B2DD23A44BF59 F964D79F37C8D53D 1834C4BB3ADC5B0A BA57E2FF0E0D2552 4B26B13DCE114791 A63ABEF523482009 2EFC7BDCBFA699EF E625AC0619A5035F C71A6D01F21CA7CA 28FEC606F582EDA9 695D1AAD4A842A8F 3FB9C1212561FFF2 D462BAFF289010EC 3495FCB1D55F861A 837425AAE345FCEF 8A7E85ED8665D186 9515B55B83D50A39 82A2C5A6E301B703 CDE63E1D03EBB07E 7B2C28A72AC20550 8C6D676B99A35143 044A1993F139E93C 4D79E645C98B976B AEC88EEB3593397A 14A7917457FC5150 A5390AF9B67ECEC0 8F4B589AD7C808A6 E020BA55EB805412 89AD0147FFB4277C 98AB6D4EC3CD7013 D7CCEBA02B0438C8 9FC3792DC384C3B9 6F39DA0D893F302F E0A46D869C6F3A3D C9A40DE0F6F1AAD0 281517B1C5B5DB62 2E5E70F62B44112E 8CB3E28DD9B03DE5 48BE097A4D0A4779 FE265CE35E5C0A11 F713EB47AD85BD47 12ACC7FFCAF589AB 5AA93EE65E6D5AB1 9955A2A2A258B28F 10166F42832C3D94 6B74F5348E808232 2D69A922AB448F16 9A77F6519B831827 114D2F65702EFC81 DBC721D638EA65F2 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).
Decrypted: GUID list
1 2eca5aed-da2b-0576-a08b-5aed24e67b17 2 613ee4dc-e686-6ad5-a774-8d0e3b58d4a7 3 7a73b67c-8bfc-452e-b970-5fb5a6f867ec 4 e299f183-a83e-7d94-87c6-0f4e72376c9e 5 d3de5ee0-71a3-5587-82d8-7cad26b5238f 6 9c6a0051-c3e3-1f26-8488-2c311ba59dc9 7 1e0b8e7e-b633-87d4-b6e4-d50f1a432763 8 2bab9808-2ec8-5fa6-838b-d4087545927e 9 dae0b601-3370-0b0b-801c-d79b47aeeb1c 10 46b95e1c-eefd-26b6-9630-1da83633b25c 11 145d0be4-52df-5a5b-b7cd-9bfd81b2b24a 12 5f7fd20c-ab0b-4e3c-bea7-489dbb79efdc 13 3a4e6b3a-785f-187e-819b-2e5203c9ba6b 14 d84c8b7a-933b-542e-be2a-46429ef5df64 15 1ffb3e49-13d1-5f7c-91b3-63d0e4d3627f 16 71afd82f-3cfd-3ed1-aac5-4a5efa8b2c75 17 ae35c699-c535-0988-843e-5b296995ed66 18 01f1fa12-8cd6-05bd-b2eb-50be696be23c 19 c0e8eae9-effd-8e28-a5d4-3ce5a502bcdd 20 d30071e3-a1f2-2a63-8cea-4688855220e7 21 31de4960-9a51-7f9b-9881-e05bc018a90a 22 e842c30b-04b7-0ecc-94ed-e168a4d975e1
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
0647518502541553008270. Exactly this sequence comes out ofnew Random(971).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 33 of Run 3 (seed 1,063,142,882):
new Random(1063142882), Next(8,24) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26). - Conclusion. Filler. The content is fully explained by the two RNGs.