201206272158 vol25
explained decrypted filler
3DES(name) ECB, 20 GUIDs, seed 160
From the post to its content
As posted (encrypted)
F4BC230A13A2A22D F2D02B18B9A08A6E FD7B8B1617FA4647 125E37210EE1C831 43A991D07F041DF6 E5B2246163F9D92B DE75DF69B04D1442 BFA3696F8AA9CE68 677CC5E931FBB1C2 5A664F535515AB8B B139B65EE0C8E45C 508B7C1803595B56 D43C2569FDEA7732 9BF51FA4C518CC1F AE767A25CF09F9F6 62D75AFA43EAD174 3BCEED65500C3A87 E9ACF48FB22E089B 1DC74C5821108E9A C43A8B5ABD763652 46D262330BC4171D FA5D72CC19F8C989 D3F49FBA0380F67F EF166994275B2114 D013E4B1164CFA34 6E4D45870E30F758 8BDDD5CECFEC3CBA C896F3E5501360AA 666C2B7401099031 F877CE2B2291C308 3FCACC3DC03CA957 DF63558750F229E1 F5D238B9E156F395 26A5BEB22D5B4973 3AB989DF294AF398 988AA5FF4CA3BC0E 91173B1BCB23720E 93C587BAF08DEF82 B44173AE4575C362 50695EBF58F1E36E 683247C2923012CD 192F0EA74196F5CA 22FF47C48B0FE784 E141290F4ABDB1B4 8D95DD3A830D54CF 5F6BBF33D24F992C DE704CCCE5E7F468 77951596EA6A4F69 25884A33528931AB 7711E05E722A789D CD3C2DFBA7CB949B 4764BB3247AAEA54 E568EB60335F018D 692F72DD87FF4C18 E909D0EFEC14AE4B 92215B2C89FE3350 BAA5A847206CF069 31588AB52421D5C7 A2ACC09DA06C93E2 6257389B4E0707F8 55DBB7FEC602F9CD 969976C94AFE4E0F 65138092F77CC694 0BFFE0762566E761 0C06D3C63C81E8D9 552474D2C1AC6DBB 2C7AE2E135DC107F C7D8A262A9BD03FA 7B413164161D0B24 BAEB0D43CB13AE60 8D84848EADCA90DB ED0DE14DB9D4EDE2 8838B7DD254314ED C2DDCDF0C6ED3324 848495F3A352EFDA 2510A99D77CEEF09 2A6B7754915244EF 135642E3B3085D55 7FBCB6D89099531B 7C480A4A81A0978C 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).
Decrypted: GUID list
1 704f9871-fb41-2a80-866c-555fad4ed4d1 2 197661b8-4ee3-668f-b53f-6ab6c90a7ae5 3 3e089fb1-15de-514a-a286-c6dfddecf051 4 3d91cbaa-ed83-6845-bf7a-36e8abf1c4b2 5 44363f53-ad49-3b66-bbf8-18c4a325c417 6 edc272f9-a4ff-36be-be09-000beb50d3b2 7 85216e0c-930f-5fe1-a133-31860b4c4783 8 52dd87c0-997b-6beb-af25-59e08b533e8d 9 1563967b-a7b8-6f66-8e95-3f12f5e1758c 10 0431f066-fc2c-2a74-a725-8b660684c34a 11 9705e2cb-a12f-19bd-8ca0-294fdc8c4ed2 12 8abd4cfa-99d7-38ab-a068-ffd294503243 13 44579cea-678f-5b21-b93c-9b522f9b67fe 14 3c6a0e4a-b946-6b5d-a677-cc9f2555298e 15 babe176e-352f-803a-bc32-a75a9d77d37c 16 7dc3c804-1d57-8d2f-b566-6e708ba94295 17 74e60c92-04dc-12b2-a285-a910ab3e806c 18 d921c0b7-492f-11ca-951a-7b407e694854 19 e97d1a7c-1d1e-0866-9e1b-23ae66ea5d98 20 cf2889b2-475a-2e7f-8607-789b7212bd37
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
26563356621356881102. Exactly this sequence comes out ofnew Random(160).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 21 of Run 7 (seed 629,367,141):
new Random(629367141), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13). - Conclusion. Filler. The content is fully explained by the two RNGs.