201206270925 vntgc
explained decrypted filler
3DES(name) ECB, 17 GUIDs, seed 387
From the post to its content
As posted (encrypted)
5FA28F632E4E1238 BB6061CE3E0CCB8B BED8FDFBFCFB3A36 AC9D13BC1F97AC55 8D049E80BFEF5307 FD398574058A7EBE BE33CC0C73FCDEAF 2A683807686BCEFE F607237E6ABDBE2A D599CC0960E3368E 4148D63D7711B994 D33C9DF3B286570D EC77B6D6F2AEE874 07C18040238AD896 2B547E6B5A4884FF E9AF51EF17405932 CDF147E00E3616C0 B7FFC0C013ACF244 8AF9CA0A206227AE A474955AFFC97409 4EE6ED2CF9DCB34B 65943106202C1821 4F6652F8E3D97250 9A7AD2833506065C 776C0A1BD7E2CB9E 866047249AEF75A3 674EEB87263733D3 ACFACCF187C2C1BE 3754B5373E3979EE 20B1FF4EC5D9EEB4 627CEF7B28424E12 DF3F14D0A5F000F3 16E4445CAE4DA5E5 DB49ED41D4FC1708 B4F349C82FB37507 BDA206797D2E89B1 B86441DB9AA67946 AAC7659B455AACBF A3154FA84E9244C1 CDE29D9D77D47EB4 21D3A1A2D9F86193 0266684A14326226 BF75441258C82CCD BD90C9B29C5B73C1 6A204EEDCFB6CC67 DC0B86634BCC3C14 79476B1B26F6DAF7 23BEEEC2B0906246 96762FB1971A602D 73B2A363D6A17E8D 87D64129636FEEB7 FFBF5A11760EE746 189497D8A9D71166 765FD510D8DDF553 E15D4C2DAEE445F9 93D3D2776927AB1E 3423E4FA4855143C 3CBFB834EF61229F 0C056FFE8A6E1E58 9774CEF74729C3F2 213AC1F58FDC0638 46F90D3DA6D5AD96 67FC765A7AD2F67A D638F4CA3963656D D7D166BB79E41953 61C8FDA9716B41D7 71DEB1A8166CFAEC 0D23558528E448F3 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).
Decrypted: GUID list
1 67da9ce9-9400-88b5-ba6d-46703c7aab8e 2 8f4ce186-bc28-3cc2-bad2-b225a49b0ef1 3 c6d9eb40-d9e9-2fb3-a52e-d7e00578f37d 4 b14533c1-1d39-18fd-b434-250d5c0c728a 5 dd20741b-61bc-8168-96bb-64463433d4bd 6 f9060baf-4816-69b5-895a-af7b84d4d9ab 7 8960d392-6e29-28f6-bd99-2365dbfa73c0 8 cd957348-b69e-56a4-8d13-8299afd5e7f1 9 06e51546-b249-7613-bab0-0e6e84c4f5cf 10 275703a7-b6dd-8a16-9f6a-7db96d5caf9a 11 40728b5b-1ac3-306d-8501-e16dc8fe0989 12 e047616a-928a-59ba-bf2d-5bf0eb1a5f70 13 55486edb-0662-662b-abad-231a94a46dda 14 08d7628a-cc06-711c-ad22-c67516e33cbf 15 2f058f26-da07-768c-82df-cbfc3eefa031 16 b3c3ac00-9c15-60e3-9f75-ca5855e57440 17 58a7648b-3850-4641-89c8-45e8119e8720
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
83218625783567764. Exactly this sequence comes out ofnew Random(387).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 18 of Run 6 (seed 652,173,660):
new Random(652173660), Next(8,24) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16). - Conclusion. Filler. The content is fully explained by the two RNGs.