201206261141 vn4n5
explained decrypted filler
3DES(name) ECB, 20 GUIDs, seed 859
From the post to its content
As posted (encrypted)
73525E2175BFC458 B7EE5812000D05A2 E8E39E513C837E11 2A19D4F4908C6BFF 98A2314B7D266286 1044DCAF30FB0567 B5D6475DE5BCBAF8 27305F727F6E5E23 D47460AAB24586A8 F91E39D322EAC0C8 71C77BCE48572BF2 E35E409FF32DABB5 C6CE18AD045AC574 4C23E623EE437F0D 854C737FBE6B6BBD 921061CD05BDF4D8 EDAE5937852C82D7 0A123B5CCD8786EB 02630906536F59AD C5917E663494954F 9747EB6019CB4F78 58B3A4BCBA286708 7DE6235C239A88CA 7C1E9BEFC121B8E1 42FF3D84581C64D5 454A425773694B29 AE4148AAE3CA0454 2DEF109B963A91DF 72391BE817750E14 130430E79FE87F83 B0262D733E7D2F43 4FE35558C5B9EE90 2B876BE1C5B242EF C3B91017896847B6 EE2BC0C42182332E 824A8F4D32294069 ECBD6E3C239C37DB 9A9BCAA84DF23639 AD1B8CECBB7913CE 0516E9C3B28E1629 412522A417A14903 D1749871BE7B8ACA 75BE63DDCDFACADC 3D2598FB7862DB62 7739C01432A27A75 E0748066B8C05782 5BACF842B1CEED43 19DBE4F45893AC6D 41FF4F6572D27CB1 5BC9C0E515E03AA5 DFE4D9848CEE4EA7 9A61422A2CB9C938 8706B79D0FDE446A DB9AE1812C99EA9F A21AF2265EC7A47C 2B4E4B2682D487A9 0AFAD9737EFCCA21 F25513EBE29FB40A CA0A9871E826ED3B 80AC45FF51439A11 1A339FD5FFB023B6 8C66C2E82D333C2E B18D883029E6DBD3 F06A3D6BD964182A 8C47AC368DDA2EB8 901DE3DBC9C91789 B3EA8157658C73D5 559A50112215E69A 1A3BE0EF80640C56 6B437A9F78DB1F7D CC2531A9AFB2CFF0 0A012EC3BB68DAA0 31DD6AC2E17D0D7A BBBF429DC36604B4 A7700B7CD90423E6 BE501A9E173A5DD1 693AC919CEB51870 00DE0EFE14C5D564 870F5823CCDD7BA7 1E5DB973B0BF8DBB 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).
Decrypted: GUID list
1 258ad38a-5169-4a38-b42a-cc1cc9f0c04d 2 36865b97-5046-79a6-b228-c5259e2b4be9 3 e5a008ca-c255-1b70-93c3-a489e02e1e22 4 baef10e3-ee58-8466-a6d1-1a5c9ff09c4f 5 e6a4a9d8-717c-03b8-880d-76878dbb8fd9 6 80e8e465-6551-2bc4-b627-7a9461654d72 7 e53ca88b-9915-73a7-8f91-bfb9abe67db1 8 cbf05a64-721a-30d0-abf7-29873f400f74 9 454b8ca2-1ee4-2e75-9965-b4bbf3293b72 10 7de05779-7153-08bf-bc3e-943055d36ec8 11 cdd1a5b9-59e7-189b-a1d9-dccacac5ef4f 12 0fb65216-e5a1-0342-bab3-f99d63a028f6 13 07d0360f-545c-1a2a-b18b-1fa562600e66 14 b9b6ef3e-bf48-3f43-ab03-2b0c65a69268 15 f781c6d0-8aba-2073-818b-22428ef9bae8 16 e004382b-c192-4b94-8f83-27fa9d34735b 17 660f0870-ddba-8e77-b96b-ba245f6ab084 18 138742f0-c6e4-5871-a243-aa67eca6d0da 19 4368e24f-b3ed-81e7-914f-4c8bf1df1c69 20 fcba1e2e-7db0-8538-8447-f8f9fafe93e8
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
47180273201013248588. Exactly this sequence comes out ofnew Random(859).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 56 of Run 3 (seed 1,063,142,882):
new Random(1063142882), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26). - Conclusion. Filler. The content is fully explained by the two RNGs.