201207271440 x9oty
explained decrypted filler
3DES(name+name) ECB, 21 GUIDs, seed 563
From the post to its content
As posted (encrypted)
27B52E3BB5435FA0 2A28C70F97D4E322 A1D179FEA78B929C 3C78034779FAE7CD 3E37126D00456831 6DF3C4B0946A5637 784B721560AE9804 CD64BAC5DB5A4792 726E3FE80C98C882 BD4CADD4045826F3 46F1DA8EEF0F5EC3 0E1FEF30DF4D247F 90BBB3A8E409BB89 1F2BEDC3848D112A C7F56EE8453481F6 6ABFCBA0D7700C0A 35E266A22642C49E DA4DDF384B4DAC7B 890E3BACDB5C3807 3640C4B33358EC6D 20B6AA453AD5407C A954F1FA21E88D49 4DF89523729B8C1C 1E00DFC40E02B923 36510F68F37D7227 929867C76E66B505 E59AC61C2E11F355 D6F2322FD0A991F4 D7C5F384D18D9083 287740D58DD5231A 8A66CD25611DFBD4 D1D56DE666FA151B E329950DD8DB2DA1 10D4C834C14070EF E68512314371E742 15D7207347B38B1A 4936BF5EA982CD83 D7CFB93E8C75B37D 723007FD8FEA6F46 2C52A27B59B6C083 2AFDCE5BE7B0E5DD EB3AFF08F0CA5FAA 663AA9E57FB544A4 4CA3A7F460D070A9 84D7A048A401E578 E098BEDC40AE78D3 375B90A19A62E6C3 70208F257927A362 095B8C7C2E9F7898 CBA46F32B0E6DD43 333E8AEC619F1FC8 7490D45A32752AA8 0B936DC2028F2EEF 2D7856558752BF6F D95D67FE3CFFB5E9 C82B44B08853623D 436FF17413FE936E A24584D10B75E9F7 069EE6CCB1D9DA7E 7E72707FECB05929 9AB01E21DE765325 FD2830F5DE4767D6 42422BDCAFD8A811 FAAC9E44DEC27CF7 FC5922A4D2457991 60FD93ECBBD2B9CB 44929B724403551B 71A4F4A18C5D40CC A20D2352EFFFE695 334A5F2B2272A7D2 1894636531774AF3 F93AB898845990A6 D976FE38B5DF6DC7 3B46DBEB8E5DE5E0 3497DD92E056FEC4 38AEBBCF87228713 413FE9BC54EB4B5C C3A0A42EDF5A4607 CDC7986179EDAE0B 277F7C56313511AC E6A2827ED6663216 8D516C1C7055D96D E9E204FC18AC66CF F1EA8D584BADEAB1 12ECFFDF2899BD4C
- Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9A858DE45F56D9BC9(name+name). Key = MD5(password) =0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).
Decrypted: GUID list
1 31d325a6-1ba8-7959-b152-72543cd0e671 2 3038a0e5-8f7d-04e4-9ad9-d11d8563d000 3 ee4a13e0-7afe-207a-9712-c20c03660497 4 bf4411ae-b4e0-6306-94f1-97e02f39378e 5 b07e40c6-d2a4-3220-8e52-1f6fb5254118 6 a68498c1-fa4c-5c0e-841e-78a48ce97533 7 17b21b65-8af1-18d5-995b-7956404c992d 8 27271ecc-5ddb-8eff-865b-d0a77b81f36c 9 ceeed9d0-d2ec-5088-b08d-2b4f5f55b601 10 841326f3-09ce-7d76-b7f7-3c305a731395 11 2c511ce9-4223-0281-9aae-a986716e1905 12 fc467f8a-4dea-004a-b508-172bc19733cd 13 adc6418b-5f44-6614-a23d-86470b403c7b 14 2e34765f-b7fc-3e47-8b29-15b14603cdbc 15 5b25443c-a9a8-0188-bff5-0eda9e50bb2a 16 357201dc-a578-501f-9f94-fac1ffe55e14 17 79c4e41a-4eb4-4620-b277-80688711c89d 18 238df192-15c3-01de-9bea-cdf7b2087843 19 bdef5c30-fff5-8530-a2e2-4e54b74268de 20 fa421cc7-0520-21df-a649-b604841eb22b 21 4d2a3aa0-3821-58b4-89b7-2e82b3a8a19e
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
702635185700630540825. Exactly this sequence comes out ofnew Random(563).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 40 of Run 18 (seed 6,051,781):
new Random(6051781), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16). - Conclusion. Filler. The content is fully explained by the two RNGs.