201206272009 vohie
explained decrypted filler
3DES(name) ECB, 22 GUIDs, seed 606
From the post to its content
As posted (encrypted)
2DFB88D5515229AA 8430D9A8CCB7F3E1 FC53F2B1298F47F1 E3DC1F424EE24472 A5D7EFE00EBC13FA 7719323FE333999D A8ACC61A8514DB55 D5D2C3A4F0192E86 C82D711C00D1317B 51BCC9A246B113D3 E95EE474D1DBC477 50CB4E9A97225464 FFD6F7611FCAFAF0 20F3452E3E0A953E F6D6A9DC4EC078F3 BC724765B8F5A220 C1E873A625163F5E DA3FE87621067461 036F5989C0B43A60 44FC160085804375 4582E87DAA216DEA B16D89DF9A0AE57F E2D87CB2AF3E1A02 17DA34580F9F44AA 131D85BAA3B92321 20F6F2E2A7674E4F E7BCF0E8114C227D 84990219942ECC45 6A389CF3D5DB9EB0 F906F370A9FD97E2 99DBD9246422611F 3FD9E75E8F2F0A4D 28B61EF188A4AECD 842F0CEDC9368B15 403CEAECFE043A20 E656330812E57095 BA5E865D3FE1F480 A561FC60E7FF1C72 1BE75FD2EB153EA8 6345590D23EBABF2 4DA4FCC09CA485F3 E931ED42FD9B0619 995BBFC4BAF042E2 2A32958FA72E941F FA28642DAB96C53D 09843753E97F81BA 60CBA2A815399528 F26C8D5B5B3202D5 AB099D4595FA04F2 710F5888AE43A4ED 327A4798460981B8 2B980F3A07DE4E69 C5146C3250BBD4A5 A77EFE806FEB1B35 11E07636027F8EDF A0EC61AE323DB06D 415643BF28F549A2 193F6E27CCC2687D E70DF8C5697253BA 9CAFBDC27FA9B38B E216284AA27AD0D0 E1A3EFA29888F0AD 9EC47532F43EB435 5827E96FBC39D701 5E5533E11B4EB3CC F29CBA36413FCF5D 5EBA3F3EB1867B53 CAF65BA0F2407328 9EED29CB9D560991 05B01DBC0DCCEFF2 AD376BACDD264F32 DAC1CAAC71964310 4C4E969F090AC5B6 2EF2D1DD4C4625F4 5DD27FEE902815B4 2AE9AD042DFBDAB9 9B80F79E5C3EE185 D32693D0CB863013 87EABEE9D06542BA 3D24898368BC6D23 9B7CC4FB4F24D5ED D715BCE649DE7546 A72AA9CD1EEDEBC6 5F57F5778C791415 8D2100B06B09BBCB 9C26B61515C3CE8D 3D1BF9FC49487124 B3EB32A77059600E 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).
Decrypted: GUID list
1 1acd6d59-8a6a-2011-a7c9-bfdfed59317d 2 54e1c599-cc82-5b5a-bca9-fd6dda49cba7 3 fc28fb2a-0633-33df-8d7e-8b75ed172664 4 e5998173-0068-8145-806c-004e72f9b49b 5 da1e1679-cf30-70a3-80c5-6c678389013a 6 81849f1a-e310-1a2c-b386-5e194d5fa143 7 906c69de-d596-3206-aa68-d03d321b4082 8 87a83f4b-f075-466d-81c7-71e358f297c9 9 1d19f2be-da13-87d0-8879-ccde7285c4e4 10 b8987272-66a1-698b-ab49-560f88a6e0fa 11 d8e77ebd-5dfa-6973-895f-1682497db9f6 12 f63e928a-65b6-546d-a496-95b1729f1465 13 53a2a62e-d5c1-256f-be4d-669d31f29e6c 14 a75975e3-da12-66cb-9f7c-4ec7c68fcf38 15 9295091e-1a95-1b68-910e-6e0ab53f772d 16 d4cb7b8a-9110-4d1a-9b30-f91e723d2d23 17 6bda5c3f-9cf1-53f5-b35d-4f2c8dd5b840 18 744b5383-e3e2-6421-870c-d2f3c8428a48 19 36428493-3ec3-08b7-b55f-cf7099b65005 20 778f5fc5-d649-8947-93d5-17c918b6737e 21 5598edf9-df09-3c5e-bcd7-27459369fbfc 22 e449f6f0-cfb5-42e3-ba68-cc16e9440684
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
2538713486652614560834. Exactly this sequence comes out ofnew Random(606).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 14 of Run 7 (seed 629,367,141):
new Random(629367141), Next(8,24) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13). - Conclusion. Filler. The content is fully explained by the two RNGs.