201206270935 vnu08
explained decrypted filler
3DES(name) ECB, 18 GUIDs, seed 78
From the post to its content
As posted (encrypted)
FFA81560EA99652A 59459470C774EE68 C016CF95AA497263 1570E5914180F764 60DEE73C50E5A2D1 59C07AEDAB29650D E462CCB52D3AB1E9 E624A6F49777A720 F8F826CEACC1CEB1 8A93A845137F3F30 D98387FF4D90626F 2002A636D0318847 FB4DB406BC913402 5BE77AC99B7D7AC4 D7AF37AB313343CB A35CDD69C736F3D4 0C35387C54EEB7A1 0E2FDA63EB6539E9 F0BF2B2BBEF6BE6F DA6C531CF30DB1F9 C8411E2323B3C38E 80075F7D9D0C54B1 FF71C69EA974FE05 0DF94BF7DEE304F4 E00C1D256595CC2D D0288594AA433D20 7FC762788FC6E9C5 3E134678F86BF041 407874302C9AC48A C2DB755082425A3A 2503AD5FE2935FC3 37A5BB0FF1261019 1BCBBCA2A68A524A 8EEA4A9C7CAD6CB0 8603CA915708867A FF15CFEA0005C959 DDF7EB944F44E4FB 829262C0C299B832 23B2DF7900B2E614 680F3ADFB4BFDE2E 39DEE4DE7442EEB8 BF473C61808FE4C1 2CBBD73D0E9FA1C7 F366F67CFBF0B389 4896A3CB0DE4B57D 73EAEA3421B11C19 336B44FB38AF9116 89B27B19903A1889 1A289BFD4260D5F4 84E232C4355424E4 01329667D4155672 9DD8BF6944F408E3 51AA104062BE9E22 5226861CBCEA0AC6 1B9EC1D5A7F7DD17 9FAF2818FC061CBC 9D0B0BE763716AB5 B5A1160938F20F43 E6FE1019D4EDC409 1FA289B8775B533F 9C4B53E47B37D42F E459A615BD2B4805 F46785B9991EE157 1142B16CAE2C3A40 9A0D4B3E4A634BC6 6AD4ACA64CC2A4FC 9014046C0E7EF405 55050DF6D839C1D0 27357B9BA3019BA8 1443F52FB8A58635 C1A089228BB4A630 0130792424A45AC1 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).
Decrypted: GUID list
1 1d65df3d-1ab9-40e9-83c9-6421d9f1467f 2 a0f49a92-25ce-6f47-87f5-3dacb87ea846 3 9790d781-4567-25ce-8e32-32741b4da0bb 4 d7d36f0f-1a7a-1226-8fbc-5e28455d8369 5 a45472a5-1768-3b7d-8443-aa9d548fb323 6 5c1d5dfe-fa39-6810-96e3-09816bf9c35e 7 e354908e-c7eb-7c4a-b467-3b86c19f3fc6 8 c7ed5b91-e876-507a-bb2a-fba47ca0d610 9 c3ae776e-3ead-5e39-aab4-2b032cb9a306 10 c804fe2f-7847-06a6-8e54-0b93985feba4 11 d69cee85-35f8-67b0-9c34-57bc93be63d5 12 ef52d593-b413-3762-8390-888013e0706b 13 039e07b2-7f9d-2819-938f-091909af9175 14 43c8a293-c2e9-0945-b3b0-39fc765115be 15 27bd53b1-0995-5b71-b6a2-4e249739ecb6 16 c7a89c09-ed55-66ab-bdcc-91b16f98f43a 17 52918c7f-5d7d-5ab5-9579-9ce165f0fe45 18 c9c78441-30a1-37ee-adfc-7e043c698858
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
462136755063205653. Exactly this sequence comes out ofnew Random(78).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 19 of Run 6 (seed 652,173,660):
new Random(652173660), Next(8,24) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16). - Conclusion. Filler. The content is fully explained by the two RNGs.