201206261344 vnct1
explained decrypted filler
3DES(name) ECB, 20 GUIDs, seed 907
From the post to its content
As posted (encrypted)
D699E426BBDAD1AC 1A8126CC602E7D2D 608F05A0746BC521 BE69E902BD8E9D43 2A5F196CA92655DB 41CD20222D8F0E47 B1D931CCC7FEA6EA BACEC3D511199DF8 85BA25AA544A3E74 05ABA6F87F7EDE75 E0306CA6536C1A86 1E027FD7A230D9A5 3873DA5384D5D4E5 50C03DBD27F6D07C 0246724A310430CF AC6ED110C214FAAB 668378E09A0D7EAB 05B5E26978890406 A81A9169726987E3 B8878962AA23E9BA 1EE7756F45308D1C 0CBF4814CADF4EE7 685129BE04C5CA85 6F17F9A62FEAC61F A955051B40FEB536 CE8EA1FDF1A06C8F 3DAD8FD53B75F85A 0051622BF38A9AF8 D71C7BBFAC9156C5 5798DC715FD8FB03 344C643E94B147D3 D1B2C3A4DA6349B6 2E6DB7D9A11EF24A A4E259ACD34C6111 C14CCA9073005885 C92C2C4ED9F3596F 30317240FFF1AB82 8030638BB05CBD05 C5EEE125609A9921 E333422F9CF11747 5A57D3431CF5A80D 2D11B7449083E328 A38357B52A469F1E 69863C25A7B42475 33EC28F75022AC31 F4A90FF0DC1BBD5B AD7EE73BDFFF7280 CFF853278A791944 6771A5E8D9FED883 59B785A732044FEF 1494B7FCC8A77ABF BD96EF6880C9D149 B51CB44B610D981C B7B662EC4B2B4B9C D5661780255BCA40 B1886AC8BD900422 821DAFFC9E7C5716 11CB22036AA6FD56 2FD18BF4196FC843 EF87404792ED26B7 6B973466C1CB92C1 BDA6F7816ED1427F A5FC50027FB7ABE6 BD6C39E60FCE2EE6 663FCB365BA57C6E B524D4B3D0C65054 A7B2B68C6E7972E9 0903F113E52141EF BF5CF880896C84DC ECB2A9FD941946E4 FEE8F2FAFFE3823F 2C5DC1D40B42D859 3F332345E3A2CFB4 5F6070C1D9AD4D62 4E9678AB62852D89 91ADFAC62C2CC3DD 2B393A00521B3563 7C85EB3AEBCAD027 75C67766402C63C6 8C362F5622CF4F71 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).
Decrypted: GUID list
1 60272873-d5ab-5d7c-b3d9-692f9f12e0f0 2 da0c594e-89d8-8e25-b7ac-4a64042e1d2c 3 625a5fc3-991a-671d-9ea1-87a647d7a2bc 4 2aff43d9-18ce-1465-9502-e503d5794cf0 5 e9d9497e-71ad-662e-8501-77eaa4c1c335 6 feb5ee57-3443-142c-b8bf-264c5cf872ee 7 b4ffaf0b-9986-24b6-adc3-018e12dfe10e 8 d977d7ab-df14-419d-9df8-a867e82c27e4 9 d19c0226-a5d1-12f8-9e2b-14fe37f28679 10 e0f45afe-7e61-61bb-8be9-96bc0dc754f4 11 fc76137c-b94e-4b16-9a83-dd0a2ad573a2 12 0670f531-8289-5dfc-9718-44a29593b69f 13 7d5b5969-c9a6-17db-8606-4190b8d8d41d 14 3c50703f-9640-34d0-8d16-139f5e349859 15 c9458cb1-d5ac-761d-9072-a937ec989b37 16 45fe6827-7827-4534-879a-e33c7d9ac0b7 17 0912ebd9-ebfd-10f5-b1b5-c34ea243a73f 18 f017d002-b720-3188-95a5-477f381cd901 19 5eb8f933-e784-2b9f-bf20-6529f1b29739 20 a181f8e1-9890-4f5d-92c8-279880cb54c5
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
58616124164513741324. Exactly this sequence comes out ofnew Random(907).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 10 of Run 4 (seed 664,106,302):
new Random(664106302), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:07–19:12). - Conclusion. Filler. The content is fully explained by the two RNGs.