201206272142 vokh4
explained decrypted filler
3DES(name) ECB, 17 GUIDs, seed 105
From the post to its content
As posted (encrypted)
BD4B934E038373C7 DC0F889759E2748B AF2FAD528C547444 BDD667A42ABAE20A 3FEB91332E0A7D55 1670584E657578A1 473A39CF94F206D4 22292256C8C65701 2082A38B8B2BCA4F B71B39B1ACF1379A EBD94C3E99BB97BB 4829755DEECE2A30 6054936140723348 0C917BB0190C1478 166E9583E910EE31 DCDAC04C7095CCF3 01AA6267B040BD32 5738F49240F667ED 5C8384CF0E9DCA49 FE61282D6F4F132F DD8162AAFB59C6C5 E77FC5A073C724EC 842D4CD439BA5C34 64A8459A533AED33 7407A99D53F125BB E8BE0B95DFEB1021 7569DCF332F0DA6F 826EE7A8EF9E5F00 145B406FC9DD3265 B410E92C262A5771 6A952BD8C14EA2F5 70B6ACF61DD7A70E EBCE2BF856D87811 7CDA4CC20AD55D22 673F78E1352C63C9 A2963FF46FEE6F86 E260F24FEE66E4D1 18D0C207713789D4 F53DC86BF13C240F 0548733F401F8312 FB15865CD7691692 12BB47B85323D0C5 C05E9E615CE2AC1D FE315B9874FF1989 3A5AB9F0A4E9DA60 7E38F952F9FD1542 314137C59AD1A7A2 C0550A72D4873A81 C6205A9757B4FA93 0A55D7E72E927774 4F3D00E5C746DD59 C9E51A88CA669766 6A8492CB65AEE33C 58EDD5A02EBB1623 7F8A03FE506A7ED1 CAF04979549F6307 339AB45AB9813A67 26410D72AA73719A D4D3DB371BF23242 4F071CAE62E47446 DEC5A2F697F52EB3 7A0CF5A75105E6FA 44852426B44FBED8 7DD0BFCFF44162C6 B497F680520FC565 7F6937E0832CA0FB 75F1814DF26DD43B AB910C58BEECDC1C 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).
Decrypted: GUID list
1 c95c03c3-393d-5b1e-8cab-64cc7ac94753 2 0f630206-2a67-5c0d-94f8-80332b24ee9b 3 4e809ca1-d78b-1be7-89ee-2b473c3f1ee7 4 02b69f11-2364-8e98-8421-bffc10217958 5 3e9ec3e6-0eeb-5bfc-81a3-c142872e3749 6 9e782c55-fe79-231c-8c41-0bd8f1907da1 7 b024d680-9df6-8eac-a0ab-a548bf0adccb 8 8f41a4d6-78fc-1a3f-a896-bdc614138567 9 e70b13ec-bdb9-8f45-9cfb-588cf461684a 10 06588839-1414-8e44-8210-48d2e9955901 11 da3955e4-c735-5ec4-9e0e-a1fc9b63ab34 12 6cf3e3e0-f677-3da4-aca0-bd1c5874d475 13 be7fbdff-eea5-70cf-be44-8ff30e30110f 14 800b0ee5-c3b3-0cc0-8ec5-771f992bbf8a 15 59c35686-e3dc-4b5e-b5b8-6c82eb76bd02 16 5e4d04f2-bfb4-5b2d-9bcd-d218d860f6f5 17 a22be2d1-64a0-02cb-be74-a3b8a21121eb
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
55185281885370450. Exactly this sequence comes out ofnew Random(105).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 20 of Run 7 (seed 629,367,141):
new Random(629367141), Next(8,24) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13). - Conclusion. Filler. The content is fully explained by the two RNGs.