201206271216 vo3c9
explained decrypted filler
3DES(name) ECB, 18 GUIDs, seed 246
From the post to its content
As posted (encrypted)
FCFAB6E6EABC35C4 553DB0F1570BE83E F8DF42FEC3C4D940 E1732D860B301AE8 06C3F163DFB42547 9731DFCE22DB85CC 5C57D428CB73A309 43E5820A35C9ADC1 3094F55930CD34A3 D34362F7A32E10B7 FDC97FED9C5F5277 6E846B4FB9024CB8 BEA38CCE29C11FF0 C15FAFFC0CE87546 AE24A6F3621E248C 64329B47953F594E 6FB951C4E87FED38 F72B7940508BDEAD B564A2BD9AB00817 4C3CBEF82E6FC9BF 0AF028627F2023A1 BC4480B5B4CD7FA1 2895AEDF54003101 A39F2A289956E326 373A6EABEC8A5B2F 49311DB23C158038 552A81B405B6EC78 C738D7B02A53E7D3 14134DE2454349FD 4CA5BB0FBA369945 F002782C9DA71CC0 469117C009367F59 230BF4AD1DA92F5D F36DDFCAD19973D8 12B689888F129D09 365BAEA0FE64721B B15459761B96DFFE 1CA3707E8447E770 F420660A0CBD45A1 4CB74405E026FCA2 028725FA5E4C763A 20DD5C60B238962C F3D74125B3C3E573 A890DA17739CF9A3 4F611934068D01F4 E8A95A7C0F80435F 40EBA2E45F9996B8 C6EF344509D2D5BC A69F3F9A7A3B86C9 6E68CEFB72A55702 DB29AD0668E1BBDB 844CF5A72E5BE7DA 5280EB7029C027ED C80C7BC39F3F0194 946233B99D268417 D9BCBEA285DEC05E 246CAB4F82CC4FBA EC2DC8490CC65E51 B1DFE0BA6733C262 14C58DF14C6569D0 985955A9605F3AD8 E6D9D89B28C3D306 86B635A2D9EACF60 1EC966D6EE097299 392CBF1935CAD8C9 D3B5EE7C894DB771 7E448E256269C7C6 D5E9251E44715189 716A913E1C119F86 C6BE68AA360AB18D 5F0515B509CF8C3B 1141B59A384EBA15 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).
Decrypted: GUID list
1 0846cf53-cc5f-2bd9-83b9-99eebb0c4e15 2 c9aabfb1-05e2-8ca6-b2dc-f672c904c28a 3 b13cfa62-36af-6a4d-885c-155ea4590c6e 4 563876d5-7d94-0c7e-95b5-dd4d9fa6f8cb 5 0c96c4ed-d6fc-21f2-9d42-9baeab794084 6 ae133bba-d6eb-4d79-83fb-f44ad2520cf4 7 ede78aa5-0426-118c-8b55-2a28fdf7e93d 8 1a7c4491-4c13-7fcd-8537-fb1df07f0362 9 4e952a7c-7388-3422-b501-5df1ab5a4f13 10 a9f36927-ef49-8278-8bb6-1ea53c0957ed 11 47ee8c25-2ce7-4683-bae1-7631b87ddde1 12 64e3c634-d323-4166-8120-76d75ce3e216 13 2aa16c60-9cf1-6807-82d6-2279408ff7d5 14 29c8894a-5371-49c5-8eb1-60ea6fad353d 15 a5de8247-e070-1bf7-b312-ff8250669d1b 16 ed889a1a-6704-5ca5-b597-735b0f67d316 17 0c7d1df2-e074-2b05-9177-695b70eaa217 18 03ebf8f7-d2d7-4678-8d0e-9dfa1a40c489
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
286024173844641524. Exactly this sequence comes out ofnew Random(246).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 35 of Run 6 (seed 652,173,660):
new Random(652173660), Next(8,24) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16). - Conclusion. Filler. The content is fully explained by the two RNGs.