201206270516 vney9

explained decrypted filler

3DES(name) ECB, 11 GUIDs, seed 587

Metadata

Post ID: vney9
Title: 201206270516 → 2012-06-27 05:16 on A858's clock
Posted (UTC): 2012-06-26 21:14:49
Timezone: UTC+8 · title 05:16 against posted 21:14 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(587).Next(9) ✓ verified
Run: Run 5 (seed 659,062,118) (seed)
Draw: 2 · predicted N = 11 ✓
Machine boot: F 2012-05-15 19:11–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

53C36954397DD39B EB418AC4EE21AC8E F4B62483390FB12D 1F4EFF6CA41A314A 8DA68C70026A3AA1 D463FB76C9ED08AF 10314405956C4792 68FA6925952977AB 84CD2E234621769B 2224B242E28C5D5F E9F3849C6CAF491D D06ADBAC82EFB4E6 A1AF85179B9A8171 558851F7CD4D7C41 5D685C7E8BA1602D 179749478DD816A9 91F98E0CA1AD2C58 0CC28D782EAC531D EF3BD56D8ECF363C 8244FB4EF00DAB2C 4DA7CBDEC3ACF02B D7ADD5D044DB045E B7E6F55CFBFC95F6 2ACBD9B556F52479 91D0EEB13EFCD157 81795EEEC25A3547 725C7AB00D7C7DE4 1E62B229EE4F31BB DB940E44849FBC6B C6700D7B2AAF6E2D 6DB4FC7F2DB9AD67 09C1A70FF18D483B C33ED4E26DA89640 4C530FF3B54E4116 E105979620A1A4BB EF214533B23A6814 8347D346E4234BD2 73D736366076F8F7 D4D03C3F4759F505 13C863C2DC21740C B089D435D0A43604 9C41D35680307517 08C1F0DBEB45E5E7 D2463FD13B9B4A6D 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b72210cc-c4d8-3452-a1ae-a5dec14879b7
  2 ec85604e-59d2-0fae-bd37-1a5ce46c63c9
  3 c879c7d3-1d4b-002a-95c1-22bf96b59978
  4 fc0244fe-f9fd-7b2f-b2ee-ee4ddd797dc8
  5 0201a11e-c91d-226e-98a5-9a7fb865dfb8
  6 ab1f5d49-2b30-4cfa-9ce1-d09f637272f1
  7 4086033e-5551-80a1-ad1c-9ace1eb81315
  8 0431a73a-a462-854c-976a-31f3ad278ffd
  9 a1ce96c6-0d61-5f2d-bf6e-84b7820a0b18
 10 9c390cee-9548-639e-ba2e-7e6bd4f18283
 11 bbe70ab9-b61e-63ad-88af-0bdeeced2b78

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 30072488566. Exactly this sequence comes out of new Random(587).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 2 of Run 5 (seed 659,062,118): new Random(659062118), Next(8,24) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related