201206271549 vp9bc
explained decrypted filler
3DES(name) ECB, 18 GUIDs, seed 343
From the post to its content
As posted (encrypted)
2BA399ACD100BB79 95C91B4D17C1FE8E 424A42A146928783 C1B328A74123A160 9DE4D0D4DF5B4D4F 5E0F967FEA3A347C 558B8692389E483A E27314D736E44982 3527C142EE74B2FF 8BC83BEB14527268 4A6DB08E0A15401C 6835A529A83A31A2 DEAF4EE93329F338 D28895C50BB6D9F1 A46E5EE0A82755CE 1D3F4408900F454B ECEC407EEA47F287 890F2D8859465E10 5836D620017AFEDE 7ACB25A602347664 5573FBD4700DB2CF 151ED019203D74D3 694149D8CF4768D6 3D5E43FE3713528D 3BCBBBEC4CB2998C 92C7E38B5D99B7C5 8942328819C438D7 6EFD2B1A32A343B9 74E1070ED4ED31E2 D428E6BC8CEAC7F8 8414D48B117A1A5A F4C1973D6006997C 024FF5EB7BB0871A DE9A113A32B311FF A3E8AA9A2B429EFC 1B5D0CFEA60BED9A ACB39463DE39F3FD 20B96969D2AF2CA1 A109616AE772A243 2DD40C405BE8AD12 FEFB85795DACAB09 9984924F0AD5C795 65AD413490DDA1B3 0DAE4B961E535CC3 B30D1CE7BABEB69F 48EEEB6BA155EA63 8A485F0472C96BE7 BE444B41C6EC3A34 655CAAFFA0D8D2A2 A50BAEEFDF38E009 D671F9FB99F546EE 551DF6DCEC642C08 31A4595D32208A3E 7B816D4F2BF03236 6A2CE07BC3299FF9 DCF72B06290CD66E E8FFB6193EEB3C62 E3C3BE6BE85DACC8 3A2848524D36BC66 787A2C12A02FD844 AE4169557465FFE3 AE1D90C3711DA291 0108521F1DA77633 B313A71A21CB0378 E852B09E65573D9F F9CF82B264D2F7E8 0D65FA4294AD131A 495D214FAC645369 32ACB9ED0C48DA8F 905A9612BF26A2D6 D619762E4AB8904A 32B290B83CCE8CCB 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).
Decrypted: GUID list
1 b4052a7d-a661-865c-b8e7-33328c10c3d4 2 60c7695c-c686-4f6b-b763-3770c4056d90 3 7360361b-65dd-455f-8e33-eba2fa37f777 4 36d01ac0-84c4-67ec-8130-e5a3dfb5af2a 5 be85e97a-c70b-0824-b105-0d3ed5567c74 6 d4376bc6-fa45-2515-bf29-6b5244d60c7f 7 3e2c2be7-128a-5d93-bbd5-59c7a114209d 8 268ca489-23b0-49f6-9f10-61b48815aa3b 9 ce635a06-4b58-3a9d-b437-0f0522e7cc73 10 7c0ac8a9-678e-6d79-b61e-0c8ee0950862 11 33b98d72-089d-84a5-83ef-fddd82db8e56 12 f3ce23f7-1f0a-2f2d-b9ff-1edd031e9604 13 082617b9-8700-3b16-b36b-44d3453d268a 14 6d349a8d-ef35-86df-aae3-96b30f22b923 15 ea5544ca-dabe-0641-9975-638d23d45eb2 16 65117921-189f-2388-a4f6-e0531d5720c5 17 65623aef-fbde-09cb-b762-01b5333f9cb8 18 5bf4932f-b02d-58af-98a6-70b11e595b27
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
844602543682380205. Exactly this sequence comes out ofnew Random(343).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 13 of Run 8 (seed 593,707,075):
new Random(593707075), Next(8,24) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:59–19:19). - Conclusion. Filler. The content is fully explained by the two RNGs.