201207271426 x9nzj
explained decrypted filler
3DES(name+name) ECB, 19 GUIDs, seed 94
From the post to its content
As posted (encrypted)
7F453EF2A8C30A20 C2B21A6EBED3C079 4E7260ECF1C9E0AB 870ABD65B478454E A31456999D914A82 5D425913E088CB16 5A37997D4C62AE61 71DC2C51DAB0A33C E54FFF23DF438551 96EEEB1E771665B8 610CCA62C1070F8F 788AF36D6ED09F6C CAAE4E1BA414E567 E92AB509B4065710 4CE99B500463095C A9C062B186935A5A CA04C77E9037CD77 A9F5074B1217A6AE 0F972214D6346AAD 451766F0AC45D50B 43067A5791764710 2B94FCADD3A3CD7E 6C732B84E2C48F85 18E90FB2BAC0C2D8 202CCD702CAAC6DA 90E36930B047F431 82F5A1557AA5EA1C CA18972A5B155C91 A2E417E123121C5E 576362E7FA6F1689 172C70E77F9AB3FF 6515DCE9BC2EF314 B210C118429C7BA9 1F1E3F903405BF5C 2CCF71E6BEB89029 4B4F5CF88583A9BB FF8035ADB53DF0B7 7426A63416B2D4E9 F5C02480E55E39F2 B15B9BFEFBB20AD3 893ABF934280D247 F11739BABDE055A9 C51B90553F93D44F 71231479B62EBB75 5D34F7846B14D154 8E53AE50AA661DC7 680FF834FFE82CE3 8FC8C7D72F2B3E7E 0BEEBB990DF93D37 D8A83CBDBE342334 C41F26E05C630AC1 A67B80E31DB6E0B6 C7A9871E8D97442C 211443607849BC5A 38088D9528A915D5 BB3799AC22C708EC F40AC436E53B5CB5 2622EBA624573A8C 1509D931E059C111 F3A0D02756BB56F4 7789C3BF737109A2 327BB1C81BC4E183 864833214036D824 89D5998A584F9558 891FCC5F4B711805 4FAA7575CEF08B05 4461BE3D11D06E76 3054C8628D81DB20 AEF2521728FEC0A5 C67C8965E8A506B0 669438300744B8B0 23991CF8ECB29C7B E836746EB349B929 CF3A95DDC317E953 E6786DDDFA3CDF0F 27DF45C57C884821 12ECFFDF2899BD4C
- Read the ciphertext. Strip whitespace: 1,232 hex characters = 616 bytes = 77 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9A858DE45F56D9BC9(name+name). Key = MD5(password) =0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 19 GUIDs as hex (shown below).
Decrypted: GUID list
1 359ad96d-d134-7d1f-9500-4740a3a860b6 2 8bf686b8-993f-3d5c-b17d-467c4455efaf 3 261508a9-939a-44c3-a8c6-148cc81684f5 4 57c9b0cd-7edd-5778-aa99-2dbd54a99e77 5 d54c0015-cbf8-525a-bdf1-bdf8b096d4cf 6 f310bf3b-cbd8-65a6-b2fb-8d1f0f2b253d 7 dc39af1e-cbe7-0c19-956c-28867dc10ea9 8 e42c435f-9e92-5fb3-831f-999c1f19c6bb 9 ce52e8a5-6c30-52d7-80e8-cf5fb7045052 10 ce13b050-b1ed-8755-a7af-dcf2c3a28fc1 11 db799301-1c08-473d-9c64-9425e10bc80d 12 7169a5a7-b61c-7bef-b1bc-294cfe71ffe1 13 0ede218e-28b4-2fbf-92e8-eaf54b8b88fc 14 08db78df-b586-3a46-8855-013b5561a207 15 e9b875cc-7ee4-7f10-b8f7-642677b5ec59 16 1fa57940-b57b-6af0-83ce-62c9d8eab085 17 2192a339-fad8-3ac2-ae76-3dcd84355fc7 18 0d698947-f650-2438-89e8-962cabd7f90a 19 a3f66e0b-10a6-1972-a945-3a09ff0e3236
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
7345560558472376321. Exactly this sequence comes out ofnew Random(94).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 26 of Run 18 (seed 6,051,781):
new Random(6051781), Next(8,64) per post. The RNG predicts N = 19; the post has N = 19 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16). - Conclusion. Filler. The content is fully explained by the two RNGs.