201207061035 w3uov
explained decrypted filler
3DES(name) ECB, 20 GUIDs, seed 1
From the post to its content
As posted (encrypted)
750DC925BE22C09F 40CAF7CD85E15E7B 4A23987FEFF7E159 C02C09D7DB09965D DCC088BE61079240 3B4FE72EDB037B67 6F9E2388F81E9967 97BEB0B21995F14F 042D473AB12B8162 157D6EEBF3B8D100 EB373C75FD476B4F EFE856DCD98B37FF 31CB95E406EB9EB6 B91BAF8D4770F454 9F0E3EEECD8F964E 7EBC3B3E2CB8056B CC2E106B8CEAB700 31ED2FFA650802B7 07409DE3464B1A01 84ED735B547BA96C 2CA4C7BFCD9620F9 0098AD9E91FD758C B8AD2BB37343DB4F F60BEC9D0431ED2B B4C8F46CBDF1E97D 7F1DA18C70BDE5DD C90704BD88DEFFE1 50FE5E5AC4227626 334A99C9C0F1240E D9C8CCFDCB17F9B7 DF9AE13FBDC80DE1 B052F241816346B3 530F5CC5103B9907 DBE5F1238C7772E3 9CEBD0DF29DEF399 BF9FACDA57AD4851 F6E720293E933C0D EAB81EE3BF004C8C 1106A3EC799BC5D5 8119D27321BEA2B6 E079793BA60C98D3 5493931013352774 9B9C999F2E89C974 DD204372219678D5 554A9D1DA9480E60 27D23BD197F66278 FC4A8B05FD68547A B27B33B66A3F2AE2 ED101472B329D452 25A4F6E647321FEA A52208EA459A0A3F 8C7C2B24C6C0DD47 DA98A1214AEEB2F3 392541DB1F693021 4BA783DF0228D04C 29578E419A30D601 20D2B5F0434F39AE 735254CB4BBCADD4 E6777E5D4B5884D7 0B5E23112C44477A 32ED24AB2344092E 6F108227B77D2695 980D78B0E933A592 0C70DF08A4AD1478 3ADD59E8D789B963 080E757B8895DE02 20B1555B811A48B8 B9FDAA162EFA2AE2 7ADD1A9988C2EF29 9BAE06B399840D5B 2B2AA55CF953693E BCBB7DB834C1291E DE60906A99AD49B1 A7F0C06672307669 F45EECCBD0D63242 7261A41035FC5986 42D41C8B32E49AAF DE1B9710E00CF92B A0C1FF6E658C1C32 D26D113CA8B7C035 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).
Decrypted: GUID list
1 99360463-f741-2b53-b9f4-4e6476c0d39a 2 f3b7ed20-1f10-06f8-981a-b43df0aa9b35 3 2c7185b6-5f99-4322-b115-03a4b0e20926 4 e009b1ea-34c4-684f-a5ef-6772c1e97f3d 5 3b419fa4-3d58-596c-824d-7544a8d8afec 6 d19dd31f-2c2f-3c9a-8a47-9c92bcf57217 7 12cdeaa9-b6f4-3528-a98c-ed2ab2eadbbb 8 4f812fc6-435d-8508-b42b-ada8d102c8a9 9 1dd73c44-65d8-00b0-a9ad-b375b3716088 10 7593d0eb-5cd7-5cd1-a4de-a3ce4a67bc6e 11 7b4abc73-fe3e-0e38-b12f-6e4b6258b34f 12 3253f5a5-50e7-2bc2-8688-550a970b276e 13 49466d5b-7a41-231c-9d2a-0c58951ab52e 14 ce5b08c2-d9cf-832b-95ca-0ebf77cd2263 15 9b1e5d89-de8c-67ac-a5fb-dba24ee17748 16 fe6516e9-4ae6-53c3-b123-966122dd3ee5 17 ae7e5ab0-e345-2dfc-9032-3011b7b6ed5e 18 cd2c6e0d-2239-5cde-a532-4b0d2c1d495b 19 43ba734a-0344-6968-9851-1ce660f595a7 20 7aed5495-74b6-617c-a5d6-d8cc765da454
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
20465338050228652566. Exactly this sequence comes out ofnew Random(1).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 9 of Run 11 (seed 37,057,156):
new Random(37057156), Next(8,64) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46). - Conclusion. Filler. The content is fully explained by the two RNGs.