201206271820 voetl
explained decrypted filler
3DES(name) ECB, 19 GUIDs, seed 401
From the post to its content
As posted (encrypted)
CF172C8749DB1314 8B465AFB042C5E80 8458624E40877D75 E589FBD9E7959159 16CC9273CB4B7FD6 D7C5FB6FFA780CF9 A36E519E9023BD82 742C2D15DE80BD90 356B84A179C477C4 957608FF959D9F01 DAECBE6BD46B17DD D815BE844BFB5C74 3B72A0765D0B377E FB32EBDB2E921C89 3C709046704F2FB4 7EB145214EDBC5CD 258443F37C93AEC5 E5FA47AB2D05181F B137C4E13AB67A19 B0A952B80682BA96 8FDA04A1E8BCC701 C531972070334679 FA53180A15F26ABE DDC1E859C5B80026 C982974665A4C9EB E8379E53D4FB99FC F40D7103C3912CB1 9EFC52DEB1C0C32B E099211F01F778FE D9637475FFDA3B92 A202C8983778D344 8ECDF4229EBB0FD9 60337756E54E532F DDE02AF1F5FC71B8 84EBFA67103EAB1B A2E393169934E7CC E1D64A16D1705746 7EFC7F23FFC63031 E870E54C8E70FB8B 21FDFC7435C9B842 570C1533C25E7D07 F1B677571D68E2BC 21922486FF79CD4D 5225BD27B01339E2 9FBD7109FDED2C47 03A187C8987B6B5D BE39E06927422F5B 8494E321B45DE1D7 A2DD2FEA4AD83227 0BA56081C40EB0C6 D41A2DAC02F09076 AE7F3321D0B17DD9 B81613C9214D11AE 81BF9BB8836C84F1 2976685886248781 4400B1B9C14D47F4 20CCC002E29768E5 CF53263AFB3E8A5F 7CB0DBC42DCB7419 08E41DB6003EBE00 197B77A1D981A2A6 205C197DC461D0D7 4BFF2324B5606699 786FC12237CB287A FD7A66F72441C71E 337907916FDD8958 F5B7B222C5679B5A 6EA68B37E2343E64 7B6CD35B61EA048A CC523DA010F56890 EC248B76395CAE7E 3C2AD0DF90C8C507 D159C796D7B2803D CB9867FE9A6949D4 10A39BD9B31FA4E6 368A5976DBA4BAAC 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,232 hex characters = 616 bytes = 77 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 19 GUIDs as hex (shown below).
Decrypted: GUID list
1 e5485b4e-8c46-1524-9774-01e2248a53ae 2 33fdc646-53b3-4522-866c-7f6b2d5ad218 3 dfbbf6b8-ced7-0e56-8789-a3817c7fa92f 4 02a36dd0-ad56-1a4b-9681-551e019c926e 5 ea932f85-b36c-201e-89fe-b7b3682b43ae 6 46ce0b0b-5846-874f-9498-893f439a2488 7 a875da34-4927-5e40-adf4-3793685fc633 8 254566d8-f7f4-5605-af24-86b7058a1819 9 e5a573a6-c014-5daf-a370-408a05c3ff4f 10 95ad9657-5c45-111d-956a-d8838073ba54 11 fdec21ad-87c8-6aac-b236-df4770ffb91f 12 edce87f4-b378-449c-b340-7753f4c20b9e 13 90e2d9ac-d569-23e4-b402-f8a0953574d3 14 3373f118-333d-0792-9ec4-9602aa1b646d 15 5730b64a-1bb9-6572-9b39-02948520f00d 16 5c41cc02-5db5-403e-bc0d-201ead978e61 17 3d10a4cb-70e5-32eb-9cc9-1ec69fcd462c 18 de5a6dfa-6df0-5018-811c-1509345e9c22 19 4718b1a4-88ff-4e96-8f0c-d2b946b0c5f9
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
1401285551642064354. Exactly this sequence comes out ofnew Random(401).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 7 of Run 7 (seed 629,367,141):
new Random(629367141), Next(8,24) per post. The RNG predicts N = 19; the post has N = 19 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13). - Conclusion. Filler. The content is fully explained by the two RNGs.