201206271749 voe31
explained decrypted filler
3DES(name) ECB, 18 GUIDs, seed 773
From the post to its content
As posted (encrypted)
317A5283296D7589 F26A95C8A4BF4757 B4F01C78E8D56488 5344C259E88F07B0 E39ED8343BB09394 DD9F79B4A240A7DC 0FB746F3CDBD0A63 2C6558BD2D473BC6 6A72CBDA2F77D172 A800E921549D71D3 3A3FFB382EC0A8C8 7E3E0CC01C2C945D 33867B0ADB690DA4 35CE9F9C0A6B140C 5E008026F37445A1 DEF15CB9BD2C87AB 3E31707986ED310B 79258AE7BFF10776 45996B62E5CF5D4C 8538AF107D225800 61B4B82ECE6AE773 18B05D6E12CF8376 9BF8408E292FDAC5 F01DE6F7BCBC9F7F 33DA8577D1849806 76835FB47232539B 24F9A06CEC531A7B 50DBA2F5B3812198 B81CCBBFF5A7A406 87778440FAE055F3 59936E8932702763 4D88C984779506F5 34EB362A59E31F62 424902BC94F8B2F4 AAC18FF475DAAF02 86D30633486DC56E F60D462728C696FA 8F8994A517FC96CF 1BAEEB71CE8D7F15 866BBBF707FAB52C 3F85DCA46F04E3AB 6F5B3F9944582CD7 34F54B8DB588F11B 315BC8675182AC69 C05659B072A72339 4ECD046E1D795817 8751EC842751BB23 6F9528AD2B570E87 AD03B8726307A71B 5C97CC9597C0717F D39437B4D164D854 EADC84D4E2036623 F35A869878AC93EC 58E1F76F17FC112F 54DE65FC605EAB66 C616E395DED6D858 A99E678F8B27FEE9 38AA06DF3659913A 0454059A8FB4F674 DF3A575591993004 DF030CB67672B1AB BE05A8637DFE3662 5497177E7702DBCD 3E3921CB05D991F0 4749CABE15D4FB0E 05806FDA9C48FCC3 E51DF17A9F61BE8B 003722508F4A5CAE 0AF3780CBBB5A665 CEA69985AC95E1B6 24134050FF6988DB 56449429D93692CF 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).
Decrypted: GUID list
1 91d9dfe1-b1ca-59fb-916f-eaf6ec1541f0 2 344ea602-24dc-599f-bd56-fc798df70c47 3 f0c85393-0cac-09bf-ad75-ca88c62e4b45 4 610cf637-1834-465f-8622-67998cdf983c 5 f29998b5-cd11-1470-90d7-c41efedbb81a 6 cef37321-d021-0aec-8c68-50e07a3de152 7 f8fa7956-7ce1-279b-93a3-9261b05a35ed 8 5c8f86d1-297f-2dd4-8e98-79aad50c7acf 9 17faeee5-964d-5751-8f9e-7abd1a409807 10 acbd8169-f2a6-272a-a780-7f68793d1d2d 11 0cf33481-2674-7b8d-b283-abd5d3e462c0 12 eba2c480-1b75-83f3-a48c-d040882249c3 13 faf476bd-e1ad-01ce-8b5b-b684c0371a1e 14 4c5c2313-7018-53e8-94f0-9015614db80d 15 e4b7ef8b-9978-07d4-b1d5-52216f33fd0c 16 fabd448c-7f45-797e-b616-eefa359a3702 17 e5c7b76f-a7ad-7cb9-862a-593c8b005e76 18 a2ad5538-e267-24c5-90cb-fef0ad7d75f1
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
550410225278050772. Exactly this sequence comes out ofnew Random(773).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 5 of Run 7 (seed 629,367,141):
new Random(629367141), Next(8,24) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13). - Conclusion. Filler. The content is fully explained by the two RNGs.