201206270855 vnrsj
explained decrypted filler
3DES(name) ECB, 19 GUIDs, seed 792
From the post to its content
As posted (encrypted)
B6FD9CCC1500B94A 23FFE20B0C1BBB42 543CB349519089F7 2C1643E2865A1E7E DE66EDE7678E1D8B FE73FD97F0A0C95A A0BF33557F6AC2BD 26CE921FF71FD4B0 DF1E43258F565535 1B3F37BB6660570B FB584DCE5224507A 099AAF58B12B8A68 C1941CAE190210D9 78C14FDDEBA1F9BD 9715480FFAA4C2E6 18245CF6ACD50D53 E133E0CCAC688612 1DA6FF8CBFBB25F3 A4419B6EB2825655 CAF8F8BF639189C9 4112EF3CCE17254D 654D8D7281F58CE7 79E34E7F06EE9725 B6F62F32EEB043F4 1870D6CF0A98CBD6 C13F227FD02000E3 9012CADF27582A42 1D825EB639EDE12B DA853D1F39ADB3B2 89F4060DE6EE2D31 E400C8DF504CA73D 70BD6183F88C6CE8 5739DA93D6BAE97E 2235737578A14E9D 6FAC2CC3A418F0CF A46D3C5C923BEDB3 1408E4FCE55B5B2C 6F309B0BB17C4B87 8AB84B8D418D883F EC60888D550DBC1D 843F4DF934EF9479 94FFBA47445CABCF 3E65AC255BFC3252 DFCFF5D488399769 E4CB0A7CDE006A99 50B44D9DF5D9C09F 78043B7E77A8F3A3 0BAF5F09753B6FE3 3692EF90A870A8F0 BEC7EEFB7BB5F304 BDC90507A0179F1D 620D9EA2DF4012C9 BFD7CF8F6F9CEEA7 A0CF056099701153 7426AD1808236B0A 4CCE46E0922B33AD 25AA248E0118D76D FD6474D50A4D82ED 8FF958ED7710AEA1 A1C6A63C6837CF77 7E6E5DDF7BD2AD7D F13E99E2614FA870 504D708EB6DD52A5 95231F39335CA68A 639575BDCD69F1FE F741F0AE3FFE6982 CB8CDC784728293E E05F2B9E32419D7A 1C5E8C78C9C33094 143F2B23F5628956 DF15BCC1130C0C52 7A883FB063C979CB FDAFBA43B2889BE0 F1C324277A6986B1 E73AC3A3589290D6 1496D561D4882E13 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,232 hex characters = 616 bytes = 77 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 19 GUIDs as hex (shown below).
Decrypted: GUID list
1 21b62f1b-2c3c-4625-a7ba-665e405cc779 2 e613f5d3-7ce4-114e-8f0f-0bd087097e3e 3 b841f51e-d04b-3d25-82db-fcfa1f6d5a16 4 be6ff31b-82ab-53b0-a4a1-02565d8e14f5 5 94b8efa1-91a7-7058-a4d5-550d6aadb08c 6 3d7c0e5e-62e1-6643-8fef-2ba0e9ecdc96 7 8f8f7ef3-f16c-63c2-80aa-2de3f43b530b 8 42ef50a3-f8d3-62ea-a725-b7b3029368fb 9 f992d4e1-8a6d-8f65-8417-fad9f8342f31 10 218d1876-ce5e-25c8-8f33-5b206f8fd851 11 38d1a9ad-7b14-7ffa-926b-12eb485b17ce 12 3a18fce8-536b-7680-9d2d-4312956b6877 13 d961356a-aea8-0e92-8f4f-37a79c612ae7 14 a72c7062-ed74-4476-99ff-09a411290c4c 15 1fd10376-5fb8-3fa2-a1fc-c24eded48463 16 fc31c740-b2c4-5ef8-99ee-6438635f571f 17 b331ed5e-5f53-7e90-b4b7-a3a4709a0cf1 18 997a0794-55c3-022c-a845-76dff5fd90e4 19 ebd94241-c859-1582-9123-2d7b2db0a270
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
4135766682770435701. Exactly this sequence comes out ofnew Random(792).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 15 of Run 6 (seed 652,173,660):
new Random(652173660), Next(8,24) per post. The RNG predicts N = 19; the post has N = 19 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16). - Conclusion. Filler. The content is fully explained by the two RNGs.