201206270513 vnere
explained decrypted filler
3DES(name) ECB, 20 GUIDs, seed 41
From the post to its content
As posted (encrypted)
F49C71B0C5609B8A AC52A3FE84EB595C 208047920545775E D30DBBD12C5B79C4 E597B70791B21B5F 3D0DA85A6CB7EF09 74A65967E6DE9293 F95D4E4F502C1223 8AE0E47932B507B8 2FF050707E9C25C3 FA0DE32EB602DC2F BD468D00B91DCF31 3372675F4C92A318 1703C2013A8E4345 B7B21282582C8548 DAA10FE30E0A4F62 48450446AED1B95A D7A6CC01DBF638B5 0E9976361A8DB54D C6564211AEDFF757 4280A77E83FC1F73 DD93131861989CC8 39BF7FD14AB0B9C7 3F7DFD699F639162 83EE9921A64F96D0 7E0577E6E1EAAE8B C8B1C577942AB079 21D3C9DD307F19F5 A3DB53B7576A81B6 B361874AD06FD3AE 84BFFC84EC4A359F 766DB89E6626F594 634F7080255C1455 6597A3641431147A 8814FE5C25451439 18D2637A5B283C67 ECB9D46A9C9980F3 C76245234028112C B9AE07692AC7880C A91636CEDC0F48BA CC1329DC810954F9 A255DA0D89F4A260 C562C2E02E058A11 15098862EEEDCA19 681F2326DABEA6B4 C953303A6CCC56D9 5649C35AD9868E61 202063C972143A5B 3F38D83907D99845 6B01294F80863FA8 589EC3778EF3D88E 2F5BC8D6D54FA36A 34C0B76D38180769 71D8F818823CFC7F 94EACAC248A3A125 6276867B713717AD 892ED5871F185E84 0EC7816C3330F95D B6AE30D8FFA894C4 30D4A9B8CE554A5A 8808564794ADDA02 DA2E5A3AE4575A05 35CB4A4CAA0B27B9 81B86E9141670FC5 8D307FA4FDB01BE4 3C5D56FF0FBE21D5 1AF2743C9763D15C C1AF84D678AB171E F94E5F3C4144029C 3244727E73087689 D3D4CAA73C425F89 63FE9CCC406DB346 831D9B87E8F39735 5FC7B74B40638E47 FCAE1564FD85298A D48B900E8FA6D0FB 01C18D83C605D902 935AE9DE6164F83A C5B8F4C0D0D5B872 A155CC43140A52E4 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).
Decrypted: GUID list
1 2f7331d1-2867-1214-8873-f8f995ac4fb0 2 261db321-c8d5-7ff9-a2df-a6f21f3a162d 3 3d2973eb-8985-37c0-baff-35dcefe3bc68 4 5fa8de28-e10b-2ae2-95e0-1adb1b8e0eea 5 a275305f-f13c-64d1-96a5-1bc47e74d86f 6 37b0174b-dc72-3845-a341-0c82284d8b91 7 89d09d2d-0f69-2991-bba8-1e73e6aa7042 8 073d9b3b-e916-06f5-ae5e-82f7a86fdb2c 9 73b3f026-fc17-0757-9414-725572739a11 10 e6a2a86a-7528-352c-928a-ec2f0297efdc 11 a4ba0d21-5553-4be9-bfa5-e5c2fadea22b 12 a5c6e1f8-8b00-4ea6-b187-e42b58ec07d5 13 ce639b72-17b2-7191-92cb-452e53c1f351 14 0ee353ab-22a6-7184-9b6b-4fb4925aa306 15 a668a894-1b15-6f00-9ef8-317488371147 16 3f360431-8e65-5459-93ac-3ef1fbefa3c0 17 f791bb92-ffd3-034b-8b1a-a19fdd53c570 18 0b79a9d5-3b2b-3bcd-8d15-afc316aabcab 19 e021939a-3942-73f6-9a4e-c15c473d1984 20 8986f5ca-8ad6-1a60-9ff1-1253018b9915
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
17326320034477650371. Exactly this sequence comes out ofnew Random(41).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 0 of Run 5 (seed 659,062,118):
new Random(659062118), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:13). - Conclusion. Filler. The content is fully explained by the two RNGs.