201206271954 voh4j
explained decrypted filler
3DES(name) ECB, 21 GUIDs, seed 933
From the post to its content
As posted (encrypted)
F5675D1E79B5F101 507E97C8EC491D73 94837E08B859110C EB70A72CF7E6C264 F56D851D501AA5B9 B8FFB994604C6AE9 267CBB2DACC80E75 37116707DBDCFA04 814DC075EFF4DBA7 10006F5CDCD985E8 8BFC14D06893BFB0 05A8DCB38AD05667 7FD5F1C47674538D E301E96639F6A0C0 E32BC1A547FC5CD1 6C6A262258B43ED5 E8B4F83F3AA884C8 E98C30042475D6AA D42146D50380084B DBA7497E9CB251FA 6DCF1C1F7C148AA9 01D23265CE9472A1 B9BE7B09A73AB671 0EBE89363CD5ED8D F061B70A34ED3BB3 169330060788B51C F0CE97D2FE27A3BC 2DC834B469B96CAD 331D50F279B415E2 5EA5BF690C3DE853 46867C44B49DF374 2CCF487362ACF8F8 D1608FE33007CBE2 768EB6C72527A170 F691848F91E9D756 B387A76939BEBEF8 D8DC123534A2A571 CC3A148E023DF9C3 8112E9D9F2AECF08 0D67723B23F18233 8417D7A2A56E798B 0DD3CCDD81BAEA38 3FB1DCE13AFDA2D6 3466E8DEC761DD70 EA0FCE4F25FB864F ACE2F1C61F319E48 DF340FDCD153A945 40E415DD7C9B9E6F 9F0A43CEE5ED1E58 7D70D9D7C6BC7922 09158DCC7A5C1845 BBCAA63C23A371BA 90AC4B7973F0751C BFDAADC60F8FB058 C3B6BF0DEC6DD3D9 9B653C92C9741D8D 8D4E023E80A2C28B A16CBC13D227A3BB ACEB6AA581B21C19 E404F1BAA977289D 3A040ADEA57CCDB0 19588D8970B7BCA4 7E33174A00C08541 87C998D569686E55 D4051C0A65AC0D6D E26E4A3C964FBE96 5C28F8BC9965AB71 06D2061BA8E94A8B B134307BBD5711C8 392484DF22F0C72B E79ADEB642A4DC29 8CE9FA3AAC2243CA C1028C6F3D6D337F 781CCC218CCD5FE1 C0CFA2B373DC6201 33BBEEAF9712B863 29FEAD3D7D3350BD 21FC91722E9D6AF8 824E5FC416CAA73D 8D6E6627EEB17A94 BC9B291300DF3430 6EB68CA0F2CCB0C0 F828FA545AC9B56F 9137316AD7EBC3BB 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).
Decrypted: GUID list
1 00898a21-495e-1f03-940c-27708af16612 2 f297011d-efbd-573b-bfc6-67bbccb8116f 3 a0d0ac19-afd8-8dd0-b4fa-c6378d02abda 4 644ff47e-6da2-6ae8-9549-22dd9b8eee14 5 040a6d45-cb7f-3d01-9e25-265b344f189b 6 20d215f6-75cf-8048-a774-a2ad68beea5f 7 80bf6643-d2c2-87e7-8715-4baeca6d025c 8 405228d5-6ee3-4654-ae1c-80cdf8de5c33 9 eee78ac5-0821-37d5-b4de-8729fda0c52a 10 343fe681-35e8-272c-92b7-af096a681ba9 11 46883e48-8ebb-5606-bc0a-22383de8ea80 12 6a9c9a83-21ee-7803-be4c-3ee05e987f1b 13 931086ea-6ee4-0aed-a9ea-ee1da27707a6 14 0c8477e0-be29-7438-92fa-02d856adcf20 15 4f725bc8-d6a6-01bf-98b4-5479bf9b8a96 16 34d97d8a-144c-6ea1-a028-6436937afe49 17 96e6902a-e871-045e-9781-8e9290d7a693 18 9cdbbfb2-7786-41c2-855a-5320b109f833 19 54cf1f74-4d8d-8fe2-8c1f-6e85be9ec1e0 20 6e6d3475-40d4-544b-8a79-b50b66ce23fe 21 780bb83b-4391-70da-9387-85207495c33b
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
158638843257070604857. Exactly this sequence comes out ofnew Random(933).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 13 of Run 7 (seed 629,367,141):
new Random(629367141), Next(8,24) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13). - Conclusion. Filler. The content is fully explained by the two RNGs.