201206261153 vn5gb
explained decrypted filler
3DES(name) ECB, 21 GUIDs, seed 815
From the post to its content
As posted (encrypted)
83D0DEF30FE7B680 C72A7005F8E08360 90F5747E9035D3CB 2DDDEC3B6102EE3A 870753E6CD259796 4D03822124A69EC6 6D79C66387710DAC 35D7A5765D2F17AD ED3BDC949E6C28F7 6266E6169149ADFB F122245DA383F9E8 FECC0D8BABE1B05A E66496CAADDB1959 1A6E690629CBD1A6 67809A27798D1571 BFB681183206CC33 8783B7E3BF056BED 5AD474E8C324BB14 16E80A10EFAC5C4A 6DAF7B65013567FB 031B1698B4BBFC7C 365135618D5159CC 11A9B65CA465FC30 C93FF8556AA0AE0E 1821F7B6686E217D AB92935C65765A51 5E652B70D65C6B7F 2A741AF037050B0D 19896DA0062F21B9 6B6794B317B598F1 B41127269239F390 4AEAA2ABA0ED38F2 58A2DFC2A6DEE3C7 7033FDB8D894E869 C1EDCBDB19E2D62C BEE2184858949727 9277CF5D510D13C8 4AC7959EFB191EA6 B6398546BE2E5D22 C85343D2F7023F25 1A96453D009A560E D7593A788A430EFF 774782E28887C581 B1AD6DB0A5B70420 1F8FC3D4FDC2B039 47D7408EE419819F 4190AD923E07D1D8 8C9FEDF4730AE786 56D013280336ED96 47A651E198634413 A8CB0518A00B7E4A E89F07CAF45F8D8C 8C2B63ACF6AF25ED 529098DE75FE1BA9 34FBB05BF207105B 09B00C58FD696A34 C2495D9012469B24 48DDDFBD8A9E77A9 D377E5A1032478B1 12BE0479DB001DA6 04A4B4CA067FB6DE 270F321B53571F94 6459A1F4CC244475 D8C5014DB78E78CF B4FDE4ABD868AE53 B867DD35B32A0D51 1F62E1FFF64D9BB7 2AA0353D129CA89D 4B6CA5FCCE4C273E C36E373DAB56A8A9 C7EF2D0372BC9317 E03982D36A54E530 BE1C58075EAF01CB 8D6DC5DA14CE7C5F 60123762ECD3B5DC 2EEC3F4EB500D1C1 D137106A95A84115 CE87AA9778183403 DD05058B77B669F8 848CF047433F08E5 CB433B17F1349D90 6F211F73DA85DA32 251E894618CBD0E5 E67DD8225E2717C7 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).
Decrypted: GUID list
1 54434e21-8f03-4a2a-8c27-959a6e46013e 2 edf8ccba-00f9-8983-bd4e-d9f474a21c54 3 4a13188b-1fb3-32e9-817c-6af5604a9d2f 4 175060d8-7c62-47f5-85c8-b97612ebf412 5 97cdd50c-f209-1dd4-982c-65f394196b9a 6 15988804-e69c-75eb-ab72-290d8428fd54 7 a0daec83-08be-0bb3-a5f2-ab47618bedb1 8 ee319ed1-e6bf-2d07-8cbc-3e68ffb59007 9 13e33010-3e25-75a0-9a4b-f0bcc6a3693d 10 ba5ffb19-bb24-7d28-acaa-b48a0882f4cb 11 edbd70d7-d781-6bde-a68d-a064a5da8aa8 12 aad20d1f-a720-6bc7-b156-734830ad8642 13 1014f963-7ce7-80f0-ace0-a69002b18853 14 0a9582ee-5d7b-45f1-ae59-e2a6775f25e4 15 da032466-abbc-4399-bef2-83d00aecf60a 16 b2f88f53-a2ab-0f27-8e7d-f2878d9c9528 17 812245b2-4db8-4df5-aaa7-587ac671e61b 18 1251dbdc-337c-2cf9-b128-ec8b3aa1497b 19 51a1f7f5-57c1-6cf5-8c63-6f7db040d696 20 7ed4df5e-a650-7f2d-8094-ab3a29bbf18b 21 c07a5884-f486-08c8-904c-2e0771698cc3
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
483417027766844042670. Exactly this sequence comes out ofnew Random(815).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 66 of Run 3 (seed 1,063,142,882):
new Random(1063142882), Next(8,24) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26). - Conclusion. Filler. The content is fully explained by the two RNGs.