201206261139 vn4i6
explained decrypted filler
3DES(name) ECB, 20 GUIDs, seed 988
From the post to its content
As posted (encrypted)
FDBEDFA25CEF21E1 3405B00A27DC3706 EA69CCF31F4793C0 5C968FB8C145E326 3A910EB3DBCC37A8 A5DCE21E4559A7F2 75E67B1D6DD87C96 49F5DEB0DDCC02C9 D1D138B768E79A55 CF62E95208459B90 08C6F38B0B3DFFD6 228C5CC5E04FE773 094D9C82672890BA 99C68A37462E62CD F6026C96E990E625 4CD8F951E7FD7EBC C48B682DE54DBF13 C76D94E7BB55C2F6 26EB1687B73ABF70 8AFEB5C06CEF2CD4 CB972267C6490B77 69D0B65A0EA076FB 73E696436B0FCA21 FD343E697CEEEFCC F9744BD5CB865C86 EF2AA798828F4069 A8F02F714AD244C5 532A23079DE088AB 3FCE3B332B4A9D19 5CBC275E2AF7079F D246E95403F34BB7 B39BA8F76DBE7985 29D202A2018DFAED AC02CF47DDB80659 6230490E9F883266 B9AEFDD24FBA11A9 22D6DDAD21B894FB DFE629599E015C76 36251A957C4C0AB8 078C98CC19EE6072 4F8C92DF72F9EDEE ED379AE1D05BBE51 CB0DF6633ED7D5FB 9C997B96A3F9172D 9DB5C2C639E44DF5 3B843E118B9EA9F7 31E868AAEF5F3687 A1BE896D39B3147E 13BF2F1E7CFA2397 16C07514440EA4CA 18CA37B6195DB17E 829C3D04F0881549 96253CFEDBF6F2CD AFD9C35F8FCD66DD A6150B0F4D22FC5A 9FD06377B8FDF106 C823BE30E5BC8FC3 E3863A035C1511FD 42FCB6678F8AF0F0 F41754492171E452 A6D7174CBD4E1C4A 031FA3E7171BE734 771AADCCFABC5F29 BBB94ED6CBA315FE F962DF0BB1290689 A566BCFAE9211A20 3C4EC850ADACB710 332546A708624FF8 ECA2EC5CB1A14D33 986181645DCFA953 519D53863F8921F9 5C70AA7BFC5EEBA1 62B087AF497CA515 B90294347B24FE48 CB41E55B9B78B101 C053ECF2DF51801D FEC4ACBF4E94A6C8 55E4F39C12D73C87 9DAD69F7F946D859 441B8DC044824874 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).
Decrypted: GUID list
1 b89671b7-838b-73fb-ad04-838ef68ca314 2 a94f3835-c4f4-6e97-a195-7233003d4565 3 12f1c866-3d04-3e36-9f71-6dfdcf349803 4 b1a6d29c-5c8b-3771-9c8e-eba14413bff3 5 c797c770-1174-2056-960e-5608672cd5a9 6 2f516744-baab-8aa7-9e93-5456343122d4 7 f945f809-9330-5a86-b6b1-f3ae360a8e7e 8 ffef1e08-c937-0606-b4e7-f6fbdff6264d 9 a9cdd124-304f-1773-aa8e-b4331eada1c0 10 cf051e42-7717-5bf5-87db-cb0a313ad425 11 027bfa4f-466c-1235-9135-4533eee2abb1 12 670b9671-c87e-7042-98bb-958412fdbf8c 13 83d983d9-ad3a-72ca-83b9-2edf1cbf7611 14 57497438-a158-4653-b9fc-2d1170bc7bd9 15 d063c200-d34e-4d83-9238-695b5f3f3c81 16 a8b78092-c24e-0896-9808-534bbbd4b6c7 17 82d717e9-b8ff-13ed-9b0c-a1122ea08186 18 a763a986-e479-4cac-ad85-426c4fcdb6b0 19 443be615-7775-36f7-98bc-70e13d289258 20 c2a2cd04-8edc-77af-b024-6fcc4ec8d07a
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
76332850151774401437. Exactly this sequence comes out ofnew Random(988).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 37 of Run 3 (seed 1,063,142,882):
new Random(1063142882), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26). - Conclusion. Filler. The content is fully explained by the two RNGs.