201206270527 vnfoj
explained decrypted filler
3DES(name) ECB, 19 GUIDs, seed 608
From the post to its content
As posted (encrypted)
14EC12ABBD621D80 CD469B7D70431BAD E7021981FC4E2B36 BCFBA99D5601A05E 2D0E406F223129BC 4B3717154F4D4FC9 94A2A53C959F9C54 97A5B1D53AE7E6FF 368DC8734711E439 B3F7D6B1DB75620F 45D2E87A9FEB7BAB BB1046D80232B725 98D7A6AF6A5DD3DF 90840B51B80E2823 CC0F05051CF2E04A 503DC0393F4F20C1 F11448C89867C7F6 14A5163029D951F4 042AC262AE4C6D69 792A7447B5CF1D7C 3F06687F63BE6F70 E8FBF711183C97BA 3DCCB02F9087B119 0BC0C1A6AF78B93C E110D8BF18ADE2A2 91B948EAA21C5216 564446E9EBBF9C63 AA84AEC19C874B5C 7E54302FC8ED458B DCF26276F56D4928 8581D9205DBBA92E 1402540EEB670BD5 0E4A07BE80EB3F3B 2D8BB007662E4244 A8F8293ABCA1CEDD 7720B2A9F2CE9ACA 237890CFEF440F05 6A97885E07C65725 1CC08B2D0172675A 1B0F12A7F19A3DA2 D58B516046E9B5AB 8930688E9214AE33 68AAEFCA181A8598 071C498D6FCBD785 81C7EE24BAF2E582 0A5205EDEC8384D2 6462D50221C93A7C 38B625FD9A556938 67675D6F794F8AA1 D5CE80985864F557 8EC9D16038ABA273 7898A5D3D64826C9 5E6BB99711A019E7 B5F1C45EC384AFB8 4C9A8F96C84104F9 12C96694ED4C06B8 D31E8EC1DCB2ABFB 311093A9FA4F84D8 67205243B8F5FC9B D4D1CEFB2050924B 1E7638B294627EB6 DFFC5BD16F1B2478 E51AF81FD6B5D7B6 DA046160F9BB94FC 2562F5A9D559D9E9 501D7E8CC6301323 7A2508989E7CB463 1765397B53D50B11 297E27543865F285 53BF4A7F336005E8 FE58476E87CC248C 8B23229E0477CF7E 689101658288ADB0 368D2CECF1D710CC A4A3391D8AD76C4A 3CA2649DD067B63A 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,232 hex characters = 616 bytes = 77 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 19 GUIDs as hex (shown below).
Decrypted: GUID list
1 633438c5-1bc7-3b06-8a56-9ec3ac8ba5ee 2 07699772-370a-19fc-a06e-fcc916ab4ddf 3 18ad8c20-dc18-639d-9541-d20d6ed11518 4 99ceca9f-1e66-2b0b-b5a4-c8ac94217526 5 688bbab4-bcb1-6a89-9ee3-8ef11e67f356 6 833d07de-b469-71ea-9b87-3f4bd985569e 7 1cf2f2cd-3182-20f8-9f0f-4ff7f0343c09 8 e93df839-eace-4ed4-8966-aa6cb989d724 9 fae07868-76c9-1c68-b306-1ad3edd3d74d 10 3d827c89-498b-40b2-bde5-bb554af46d67 11 a6c08d5e-e30e-2fa3-ba20-e3ef8b5d6535 12 9418e960-6d1e-1e57-ad20-c3770084edd2 13 46315656-15cf-50f4-b30e-5e772469c8a9 14 a125027b-feb9-7028-adc5-3fca9a61be77 15 c33c6ae6-3fad-5a85-a66a-73217fc1b2b0 16 eb28aea5-b925-6543-92cb-b703319bc3cc 17 0843b40c-62c9-321f-8a86-98d750f65234 18 1f0033fa-978e-8ab2-ad6c-8eb27589b4c3 19 a7d9b608-9be9-1ad7-b88e-febc49b14373
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
3162672414215756381. Exactly this sequence comes out ofnew Random(608).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 9 of Run 5 (seed 659,062,118):
new Random(659062118), Next(8,24) per post. The RNG predicts N = 19; the post has N = 19 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:13). - Conclusion. Filler. The content is fully explained by the two RNGs.