201208112250 y2rxt
explained decrypted filler
3DES(name+name) ECB, 39 GUIDs, seed 876
From the post to its content
As posted (encrypted)
A066E690CFC3B00D 85810EFE30BBBE74 8C472E905B19FAFC FA10CCFB9DB5F407 1C50030753DC59CD 466D531B540BC368 A3738648B9B1D56D F0918B480BF194E6 FD12F0E66795E1E7 3AF7B9DDC29C0BB9 1BABCCEBD9921B92 DAB7E59B5FF26A8C 73154DAD36281CAB 971F85B0EB8A93AA 012C3FBB8E7AFE4D B665BAE9629D32DD B2CD860131C23DE6 5F1EE495E3753ACE DE1F0B124C3A81E9 DFB2A5760E73FD55 A179054E14A0FF08 ED86AC20A4BB717A 9BAF8B06E9B3C96A C77E2500FAA7E452 7D32CF2C9E11E1FB E7274185573C9052 340CA002C5F2CCD5 247865F55455D0B8 5D160211FA2A413A B420ED6E6848E259 85435EC013D3E8DF 809CD62D1DBD7C36 772744F31047F7DC C3306A04C51C1EC2 C02B0746802BB3AC 910F2CF8D6A1F399 4E2B01A643C75023 7FE90A8FB4C1A066 3B31D8E3C90A60EB B3DE41B112C947BD 68EE22A7B5ACF13F 73854A1AA1E7E3BD A6013109300B27CF C6B46F683FA764A3 996E83C3EB275537 AA5164FD0C62BACE A7D3B1E6AD1CF2B6 9EE8D77A7EDD4B79 74D524AFD6A34A6F 77EAE72A9E7AAC16 4CC8758C1C65854C 3A91CBA860CEABDA 20E325B532DABC8A E4B121AF8AD15636 BB4189A6E27925C6 12D537F082A5033A 8EA9A1DDBB56A88B DADC22B84F9A2B36 1C2346CD36431A23 D6A7170EC8317F3F 86350DB6C21D16C3 4C1EACB6E2EFC3B2 C467983182A206D6 7B532E5BD4DAB787 3A3483D50808DD33 3D855B710D1B9C28 3567DFEB17466A7C 3BCE154D30BB3EDD F33220518AD8F1E1 0DC70020F68A8466 770E2300793914ED 65E699A1A35A09B2 0476B47715CBCC43 8678AAB818CFD41D 795E3B0E5E2A3007 09298C06924789E4 1730FC9E55BFBC88 34E0E598D7A26269 8B64341E89988E21 8C7DA024CEF31F19 C47270D5A8C3B28C 417D13F4EDFD260C DAE2365161710F3C 127B4385B9CA73CB 62D1C2C910F84ADE 7863511F76C3C893 899F224E467DA295 F97520454B4CCE3D 59F3E7E0156D61A8 02BCCF6ABC87E4D5 41D4545BC937AD04 A2FD25CA8D770E4E 7AE5B9BEAE524CBA 395934B6B320FF25 4D35C1207E2E5A2F 60B06E6CB81E8E5E 62A5B5AD1A2155D5 B59893B7999F0ECB BB3B1B3CE285AF8D 17E00840AF8E65B8 5A0D4B984E75604A D8EFF517CC8E1B17 F4DC22DB1584C57A 613623887820DCD4 FF81C92437A3EDD6 2E21C1962C13FDF0 B96C2FA88DA2160C F11F2E2E5BD570B4 63B936B69CF95F5B 330EC9E380979839 35E1869F30730D46 37487763C941C802 CA21CC487BCC360D 6AAF867680CD917A CBF721DEA325C9D0 5ABC52EF16848B85 20337704E1CDEA79 C5FFF4FE08050112 8325F7B7EC95AB09 16CC22E57B1D9F24 AA772E79770E8C43 C237B1E5ED25C70D 35DA523BD82558EC 3C9920E1A19893FD F2436ADB5992EA10 B31ACC691133C59D 964C34215B2D11A2 A9ED40DFD003A0F9 0BB28DF5A9A1ED56 744C6290EBE3C0E2 9CB653C74D57A422 C3AD008E401A8B7D A0DE20F1364ABAE0 9054AFDCC30BA765 95F02BAC6334D656 3640D038098D59F8 F30D030BB94FDC16 5C9473B36D832E4B 0AE04F6A0B6B4F82 9EF2CF6A9215EEF0 1DA7402D24A61558 C87B95FFDF486244 5402C81E6036B5F0 0B10F2606A7DC447 962DB39A271DFEE7 7006DE10318F52C7 5FA9BE3A2BF50E5B A0598BEE3D2DBA8E 5E8E153AC38FA85D 96AD48D2C8607BC6 C287125D583E7A6B AB5AEA8658E53EBC 5A72548396E09CCF 011579B8233BBF30 29C1F1350C17983E C7959914A658FF7F 12ECFFDF2899BD4C
- Read the ciphertext. Strip whitespace: 2,512 hex characters = 1,256 bytes = 157 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9A858DE45F56D9BC9(name+name). Key = MD5(password) =0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 39 GUIDs as hex (shown below).
Decrypted: GUID list
1 64f40abe-8a8f-3bd0-98b7-89678b01d11d 2 9ca57ec9-191d-7070-a009-ebaba61a2047 3 f56ddc05-27de-02af-934e-8c1cedda8fc8 4 97b9a34b-6e8b-4ed0-8350-30ae593272da 5 ebe86d65-e986-6a3a-b98a-fb2ab3eb919a 6 4cf51574-c561-06e7-aa29-f966155303ae 7 91ba9fd0-b50c-3581-9120-b8a155356d2f 8 df03372e-dc2f-8026-9fd7-67776c03bad5 9 19a0600a-b090-3ebf-a22a-84b10510e27e 10 b1b97429-9310-2adc-b4d5-81ba7e161d02 11 040fca3d-40cf-6839-9693-19a34da3e6cc 12 c6963ede-68eb-3096-bb83-9316f8c080b3 13 67268ba3-fbae-7cdd-98e2-9f683765ecda 14 19eb114f-f384-1e6a-a62d-c512f34b776e 15 0de81249-6a31-10f8-a427-4be9f96193c9 16 d0c6d251-b694-0096-aca8-b3b3cc6e9c6a 17 f5392dc9-4e28-025c-b3ae-1017b5ab5c44 18 63c3f161-edba-10ff-8289-a0d6eca16c4f 19 6239ed97-7954-3999-a830-7eb46b5e54b1 20 57c7bdfc-4389-49fe-84f9-53107461fe85 21 e9b3f8ea-b3a4-1d83-81bf-b152dd2cb231 22 c78816b6-a4f9-6cb3-91b8-de297e2db1f8 23 759f392b-0b7b-0dcd-9d74-d911379b24f9 24 5415d031-5306-0433-90ae-0ac4a7cde230 25 684d3402-e026-4c9d-9a2e-c65a14debdb1 26 7536f2b2-e0d4-8e4b-980f-3aef262fd184 27 37c908ab-cc36-0ada-84ca-c1448b56781f 28 79f98e11-441c-48e1-b64c-c91146703c4e 29 fcf5c0da-0d21-4c23-b706-8d71a4c10fd3 30 e026c486-d71c-5663-86fa-07a3c1b93f39 31 9fc1c313-6f87-59b6-8d05-a1f9133b1916 32 0d611203-cd04-11b6-922e-8943c9cff0fc 33 1721fcd4-2739-5a42-8751-c6387aea1e14 34 c029c48e-c03e-8cc8-acb1-6a47cc4e0dbc 35 4e03d144-e20e-439c-897b-ef718c0cd68d 36 67b12999-47a0-6eda-aa16-684e26976019 37 72c895ff-bfea-559e-babc-28939a8b24d8 38 da9cfe26-2e0d-3a68-8490-3832f796a2e7 39 61f49b27-4648-36d8-bff3-eb22ebecefa3
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
370460383263711001341600480445515846533. Exactly this sequence comes out ofnew Random(876).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 61 of Run 22 (seed 528,385,484):
new Random(528385484), Next(8,64) per post. The RNG predicts N = 39; the post has N = 39 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13). - Conclusion. Filler. The content is fully explained by the two RNGs.