201207271420 x9nkz
explained decrypted filler
3DES(name+name) ECB, 20 GUIDs, seed 266
From the post to its content
As posted (encrypted)
542472D30E65127C FF795BA2CE0A364E 64BA6DC30A95E0F8 0A8217F242D2F860 41D492F1CCE4200F FC4379AD511E4790 CF1D94665C04C788 C03099DD14EE307F B577B77531751662 B90A847FCEC6A151 3B8638A3AF289EC3 F3F8B7D5F807F634 CC478A1D70864792 E17B7582CF1529BE 61DBC5A9DFDBD2F8 CB5375BF7DE08633 4375FF6B25DF4974 01211550A2C0E14B 663B66C11DC13690 661892AC5441432E 2FA852CEBF757A0F DA4D338233464DD7 BEC7647DEC779092 01035B60E1105CF2 BA14FFFBA77D057C 9A4131628956A4F6 D6915C171BE52499 EA8130F330B2CBA4 713FCA421614EAF6 8729949FA3DD3289 1F1DA711E451382E 806A6733175C1B43 C8B514FDE0D24EA4 86D540693EEA7E22 7CDCB6FB648E3A98 2F03F0623D186FB6 0D0A13ED70C4F44A 2785DDA0897C6DB3 CD17D1934B650796 2AB8CB3BD7227185 A6510E4B34CA9FE4 9BBC5B84758DDC0F 459A861991C03D2D B89E9F19DFE7857E A574AC1E5251E30F 32EC577DC6B03117 3D5E3BE25E92F092 192718F82EFEC446 3A9AA985BCCB0DC3 3AB8309183BEE11B 138A3FE78ABDDDAB 1F0DF31414DC7391 25A5B273724C2F00 F86ADCD7061DD095 B0BD114A878FC270 FE8392565FC1ED7B CD2EAEFA65A6CCDA 60EF9FFEC621023A 002ADA8CF0BE520E EEAFDF62A6089CBD 0063508382D8B33A 73D203EC368FE9AA E23E3004C93A4E9A 9E9F068ABA610018 F3E95959E87415CC FF0165167F9B2F5A 655C6700E89321D6 BE4F033AFC69D20E D47F93F858380E54 902E5343A7EB55E4 3D97F8C0D3E836AD 556D85FABBCB1B81 F19E97252958B96B 56E7FC5D7932E72A A3BBF4E4BBA434A6 95938F72D29DEF30 5AA1434D6A8597EE CC8D9D694F37798A 127C50A75D23B8CF 8F0177CA12A1A1C0 12ECFFDF2899BD4C
- Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9A858DE45F56D9BC9(name+name). Key = MD5(password) =0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).
Decrypted: GUID list
1 4294db65-796a-6b76-aeb8-c3372d10c1df 2 755afc4f-9701-7b4f-9b6f-442970a860d0 3 947faa37-2a3c-652c-80fe-360e26b8baba 4 487feaf9-c7e5-33f6-9811-b3352b27c836 5 64e76444-f1bf-2528-80c4-1461348af779 6 59f2a4ee-fa23-0fe2-83b3-eb4891ff4b04 7 52e76cbc-edc5-01f9-94f4-a4ce4e74d4c2 8 c6d6a433-9edb-899f-8e5a-165790a3e919 9 ffc5ac07-a569-78f5-9ee1-bceeb48ac91b 10 1f5ef2d0-51d1-32f5-973b-2002bcb3b132 11 96055a12-232c-26fa-8d4b-dbc7d1849ee4 12 030db922-3b4c-1ee7-a32b-341fa89e0cf2 13 f3f8dd61-b324-4cab-a37e-2d16418f90b4 14 05a26f42-ef8a-7ff1-8f07-8c48e80ab2a1 15 4f6a6a2d-5246-17a3-9274-7c10ded8a09e 16 ab919390-294a-1e2f-8984-e9ee46281720 17 63b4e853-17ab-6970-8c29-195391e81659 18 598f327d-1e66-8208-8300-d3d5b072021d 19 bfcd461c-fdeb-7db6-a8c9-e2b0289b65d3 20 2e785c57-5efe-2f5d-aa04-c49667f41a64
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
67632008732147116872. Exactly this sequence comes out ofnew Random(266).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 20 of Run 18 (seed 6,051,781):
new Random(6051781), Next(8,64) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16). - Conclusion. Filler. The content is fully explained by the two RNGs.