201206271349 vp17x
explained decrypted filler
3DES(name) ECB, 20 GUIDs, seed 353
From the post to its content
As posted (encrypted)
71200EBC69140A84 FFF468A38C708BD3 EE549179465487E2 B17802810DAA83E7 B307E4DAC8107B6C 8938E63AC94017B5 A17F545DC298DCEB 7560E9D81630B787 8D8575A0CB6DEDF0 F49C7C992E2336AD EE6A44BE9867AA7D FC1A85454425F0D3 5F67FF1A08A95320 B98E2945964044F3 102C558C67D798EA C400185A4BABC6E2 D3FD024FC9E87318 B58177F4EEF7E9F3 7579C10F523E2E95 F4F63D4C6706CCBA 2F17DFEADC5546A6 7566292F16A4F0A6 0266FF2E2DEDCEE8 D8B98125BDDAA9AD C3944ACAE27EF104 A5EE8D569B8CED7E FBA46BECBF63CA49 ED312D3F0A223A54 B3C26F1AE875C09A 95EC0964B3A82EE3 7CB99FE342D7CA4D 6EB9E976631743EA 506AF4F82F7DBED2 B94856AFFABFF98F 85AFAD2CC0117390 8216BC9F8CFF70C3 8B1BCADDDF9EA15F 8EE1F609BEF9FE3B E524D8C1DACD848B 897BF54ADA7C9667 7740EE973034F40C CD3920B8817AC77F 397EB9FF31D35608 0A6EE90952EF87FA DB9360B7EDB36AD3 CD1AB5E06611E55B CE1BB794793B2B3C 4595B5F5B43D8648 7A67830438313657 F9573E84E17480EC 30C73C3CB38F2885 F3C826B4169FB793 CBCA05F71DC033C4 EB10AD9E4836434F F57AF9B7956B84F0 41803F1740B17AC0 FAC882FF5E360985 2748419839635391 E36F7F134F082429 63A20103FED501D8 264DC65D909C539E 4B2DBD54E7EDE96D 6510681E79C11DD1 E688BDA9434E716E A495A9E2E84A531D FAC8ADA1429E2420 7F71AC2947B8C078 FBE9335DFA5C44C2 F49E59BFED56232C 7D6FD5282116AE1E 0FE863F2C3E29EDE 8314F669733437F0 0AFD39051D6129D2 CF6731A421918D06 618BC4FBCB2358B0 7A9A02437D03564C DA72AB0F40D5C749 7B161208027FB9F4 7D01EC9598FA7393 97E5B7FBD671460B 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).
Decrypted: GUID list
1 0efd1c7e-5b96-17de-90d0-4b45abd139ff 2 57c3adf4-8658-368e-aad6-867370dd2e6d 3 d0252fd2-a0cb-4dd0-b702-09d478e5fe28 4 8cfb4c7d-dd9d-8a3f-b617-05b9df3d8499 5 3ebb161b-f198-5c9d-b4fe-ce5548770621 6 32925df5-97cb-0e46-ade8-71ff353e4714 7 f846e39d-b071-00a9-9537-54294356973e 8 8645b05c-1167-47f0-a997-f4ebe6ba84fe 9 a55e26f1-0e2b-5482-8524-8bb8e0c36e36 10 d5285f03-1c06-3387-8cd3-9fd9084b15f3 11 c85bb100-30bd-39c9-be14-aa88157fd32b 12 64bba39c-3d51-0e9c-b371-60cf019ad584 13 8121d1d6-cfff-2f7f-9c56-d25eacd14ed4 14 09377982-adf4-1134-b846-29ff019252d7 15 91497a13-9f99-064c-88d2-7bb3c09ef240 16 ab07fb7b-1e8b-4ab1-820c-2c807463d980 17 b228da22-125e-2713-8e16-6bec06ecda89 18 3e8cc4d3-4f63-7906-9155-74f55a47f270 19 2d3c3d20-d7fb-2edf-91f9-d9008087c73f 20 b7ff6dc7-2fe9-8aaf-bf71-069baa9f5281
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
13485004533021042728. Exactly this sequence comes out ofnew Random(353).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 7 of Run 8 (seed 593,707,075):
new Random(593707075), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:59–19:19). - Conclusion. Filler. The content is fully explained by the two RNGs.