201206270514 vneug

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 365

Metadata

Post ID: vneug
Title: 201206270514 → 2012-06-27 05:14 on A858's clock
Posted (UTC): 2012-06-26 21:13:12
Timezone: UTC+8 · title 05:14 against posted 21:13 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(365).Next(9) ✓ verified
Run: Run 5 (seed 659,062,118) (seed)
Draw: 1 · predicted N = 14 ✓
Machine boot: F 2012-05-15 19:11–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

0FAEDB0C51D97A4C 664DE18E7B20A9A6 965446DFDBF5B976 37EABC00E7C7CEEB 9E2BD9124992224B 765AF64C1B985DC4 D169728965955C75 1BC9B791AB67FE61 D85BD741A2BE8B13 1C6A2FBE40A9189B FEAB937E883B9A6C A71A51FC7ACF7102 63B3AABCC7639C13 56EB696E7EB64BC7 30EA20BF1F606A65 4DFE8F5FD17F3BC2 F29AB4E8BC81775D 252EBB2F1753CB29 DB6F898868728A31 74BEDB408893EEF2 0679248179807FAF 961B65BCE97D5182 91E1E158BDA2B37A FE0C6F553BF750D2 E4C39525C569D9C6 49AF46B88C10DD81 A7CD41F71A7BC2F6 0BCFE23E94F49A1A 5784E5070DAD85B3 EE30E37629B26915 D09EA6DFBB69AA09 75B38BAF9A3BFD07 7EE2515FA7256829 9A0AC3DD1D174630 FEB4B96309BB6647 BCAF8DE202B12E43 71D542FD3169077A 6D3B725B21656430 6E53078EDB0D285A 1F8D9B5BFAEE8534 1A966F92DD4A4FE4 0A72CF42CD63F98F 28F88EA60FB8BF2C 0013181D2037FF8D F7CAD9AF51352DBA EFA386157B83E93D 63A3A3E97174D3AA 1083E076644FDA9F CB140F8F903E9C00 1007FDC223A19001 DBEBF272FB75A663 218669970504A35D 0F22127393B2D141 AE7047A8B4DFC2AF 5AE02D574B01EC36 68CF4F8C536E0731 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c20880f1-cd25-3681-bf55-83e5bb2b13d4
  2 802f29a4-6478-8e0c-a7da-b8846b58d2cb
  3 378ae23a-8742-8cf7-a908-b3ce12fb714b
  4 a535d538-d386-4055-8b6a-b0655586adc4
  5 73239be4-9051-80c6-a76e-e2984d8d53d0
  6 a8d63f43-7fe6-4be8-a08b-e3ee6b18046a
  7 8a430295-9268-4c5e-8208-8649907985fb
  8 9aa84f2f-104e-51e4-80d0-cf883bb6b67b
  9 507dd754-9f29-1f53-9209-4f1f67c0792b
 10 60a328c0-0706-77d9-a5b9-bdec96df37f9
 11 066fa524-f3db-15dc-b0df-355228d4b2bc
 12 45f4d5bd-3121-3648-b862-8ecff04d28cd
 13 fc84a743-e515-4135-91bd-927b97a84019
 14 7142dc7b-f6ba-37ab-b927-7479acbe79d1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 38848445171343. Exactly this sequence comes out of new Random(365).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 1 of Run 5 (seed 659,062,118): new Random(659062118), Next(8,24) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related