201207060605 w3fjs
explained decrypted filler
3DES(name) ECB, 13 GUIDs, seed 439
From the post to its content
As posted (encrypted)
F5B95AA6264FE14E 340E7870078C2E71 FD56E12A1A66032B 67030A9A6A689587 D56517F5B1FB5CF5 9CF660E7BAA0F3D2 73B96EB7F60514FB D9C49BFCD26C00D2 00DF653B51547D29 CEA13D8072810EEF 16981FBA41B16CB4 13C4CFDB7F409780 DB9C2A095BCA831F 2C7F0FFB29DCC008 B0D5A610B04E2BE7 BFB89C7381E02A66 EDA27C0DA601B204 5D3EAABC6722931D 88A7831B06006B75 5A685D2D4EDF3B47 8E238D532B41565C 0D10BD478DD08700 58BFAC135CD1F415 AE9A519043B7F9BA C42C0475DD0F6534 3509AD97A8E94E18 5F81E04B5D215FA9 1993C9246937064B 9A95B80EA42726E8 871D950CBA55F43A FC72B1E997F857D5 EBB15DD4C81A54C6 D231DFD5AECA5C46 BEBB2285A3101591 BA40D1FA85EAD1F1 CDED1993CCFF8772 C848D0D91F508C37 1210EC5D5E2C7035 9D178A4144984B9D 9E6BC451D474519D B3AB14F2E7917188 2BDF818868CB9DA6 320F1313DFEF8F86 75AB6AC089EF7127 67BD769D952BAA1F 03826A4AE5A621A6 015E8A55656347EB 05088260E0C07B81 1812684306FB8370 7AEA81991D38DF5B 14B478EFE5646571 AF0F49394535914A 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).
Decrypted: GUID list
1 d5fd99c5-c682-07bb-9685-b4fc11e71f60 2 bba4808e-65bb-5b9a-b942-7cd22a25df9e 3 75f192ec-aeef-5ec3-b432-471791085874 4 cb7f41e3-3d5d-2caf-9397-2cd2d7ee06fb 5 32560d14-fad7-32f2-8ac0-93e1d00774da 6 1eb702ea-1909-1749-b47a-1d636c82e1be 7 a5e0a69a-2e0d-5929-a971-4adaa09daf20 8 2c8b6ac4-5a45-60a8-952a-dd71e6340dec 9 b487a1f7-01d7-2507-a10f-afde75a40a9c 10 1df09dfe-8c61-1fff-931b-1d9c1f6e9f73 11 9ada44af-cff8-65fe-8236-815f17fd8f49 12 ae754e2c-811b-1190-846b-42f7987e008e 13 07643dd1-4900-33e7-98ea-85cf12c573d0
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
0552315621613. Exactly this sequence comes out ofnew Random(439).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 0 of Run 11 (seed 37,057,156):
new Random(37057156), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46). - Conclusion. Filler. The content is fully explained by the two RNGs.