201206261139 vn4h1
explained decrypted filler
3DES(name) ECB, 21 GUIDs, seed 196
From the post to its content
As posted (encrypted)
7A621096A2F516FD 4F1556164B9FBB76 E63CF99C892D52C0 5FDBBD6EE102BBE6 3045D10B63622D22 18C0A413E0D51D38 BC357C6C534566A7 2B680C08184525BD EA5B0D12B9794060 A1CB7932F4A8A535 FE34581EBB5F018B D7EDEDB5A1126F03 0A94DDADAAB8D500 D98E8849D8FC935F 1E3A67E57EE12852 B2A1D8693B538BE2 56A62A567DE1C62A 10F819A9E7ED965C 43E2ED2233CB0B1D 43A7B9454822B962 4ADC83261BBB9938 B8B9EFC7202A483A C1594D3CF258FC3B A8B659184C681379 74E77A4A74C4A95A 25A1BBC5C3387241 97ABEB3155B9D4A3 96EFB0F6E3E2ED1F FEA966A0E3254366 C07643E99C72B9C0 1342255F2BD5C18D D14AFA2BEFAFF1CC 51E0071D15D0295C D8D06F04A5B348D6 707C744630E781E1 D61596DC16581791 065467F3BE8C2E8F 5616A5CABE53D2C0 8A3604AEC8B10496 E6C3EAB79F7674DC E3C4FE56A56FCB10 C5FB04A22460B978 396A44F2E7DC9A01 47BE3FB000F3D517 D8E0034BCDEFA432 082B3EF5EF524DD4 E87FFEDD67D34B42 C40CDC860AE23033 A8ED035D666C6338 9794C088248C49F7 2CCFADD390C4FD8A 11AC1D1A384E8894 1C06981A962C3BB3 28FE201FE1C3F3A6 6F8A9BCCA35D53C8 9788DE4A7DD7E9C7 EEC5EA47D603F38B A182B25E7A071A6E 3E9834BE5C22F036 6ED03CDE6810B36C 92AF0EA0D5DB932C 1E9475D0F51F7B31 515313BB3D2E8F17 0311B89D19DEE152 9322635E150D376F 21369F6810175A1E 3A07EE22F3B4C7D7 9FE312EA663792EB CD42E33DDF2C2E27 0B264811EE24CFA1 8FC4856606121DDE 7A9253CB440FCD3E 39AADC326B7F31A3 FB7AE1774C166ADF E2B7ADD5D0EACC39 099A74AC5143B924 B76C036EADB6E94F C4128B9B0B5EA238 8766089969243836 E323C664B2383A93 4D3018BA0C8164C9 64B21ABA2A6C8492 7305F339FD327B29 FCEBFAA38DAA211F 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).
Decrypted: GUID list
1 ebf9f950-a411-1928-b8fd-745260828f9b 2 135899d6-8add-2ce5-8a35-07cc36390d48 3 2d477257-89dc-6996-af87-54d601713f1c 4 cc310f65-b0f0-3121-bede-fb417d88a6aa 5 6ca0fb04-ba6e-6c94-8ef7-3969bab69778 6 54ce6b57-7072-79ee-a157-64a14eb0b029 7 f7885097-c1e4-619c-9e3c-69e0c0320ad9 8 87549b6a-9882-67da-af4c-e9df04aec02c 9 2f96680c-9c49-287d-bf67-4dc305d8ee00 10 cd762aae-2d80-4cd9-bfd4-42e24177a33d 11 9b57dac0-ff64-60d9-b3ff-2953296a0229 12 35b3f5ae-66dc-4217-b113-060b36692865 13 53d1a9af-194e-3efe-be26-42da5d8d75c9 14 a6d2c3aa-4eac-329e-b940-ab6594531474 15 9781003d-07e7-1fba-a4e3-aa1510e1c6b7 16 8b6e551b-78b1-3bb1-b442-d0e211c7df4e 17 fbb42691-c46d-294c-a0ad-c3dda083ffd3 18 2a10dc41-82e2-4b1b-a456-6e824371fe85 19 d0e1923b-7515-81c3-9892-d0edbd6d8007 20 c88a4d44-ece1-1681-be69-5fb9e0314184 21 e98612f2-3e9d-7767-a66c-e42cd71cae67
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
126367662464331324817. Exactly this sequence comes out ofnew Random(196).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 34 of Run 3 (seed 1,063,142,882):
new Random(1063142882), Next(8,24) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26). - Conclusion. Filler. The content is fully explained by the two RNGs.