201206270519 vnf5o

explained decrypted filler

3DES(name) ECB, 9 GUIDs, seed 791

Metadata

Post ID: vnf5o
Title: 201206270519 → 2012-06-27 05:19 on A858's clock
Posted (UTC): 2012-06-26 21:18:01
Timezone: UTC+8 · title 05:19 against posted 21:18 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(791).Next(9) ✓ verified
Run: Run 5 (seed 659,062,118) (seed)
Draw: 4 · predicted N = 9 ✓
Machine boot: F 2012-05-15 19:11–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

7AF90C31BACE4010 6DBA771E71B43B66 406597671C3F0B5F 87A465B95F24D235 1D3B0A2D92240E92 AD4E72DBE335F7F1 A30C078B8A2B84E5 C7D7B4E24BF1D68F F2C2882A443D1CA7 5EAEAE71C1845EB3 C74FA8682DFEEBF5 296119960AE83EF0 019CE9B2A37BD767 C45026B45FEDB8EF ACA3A6E3E8274E70 11BB23FC8BAA4E58 83DDDEE6CA38DAEA B8AEB1A68B0E33EE ACC893847A495ED8 F80717A197A59ACE 5AC8446F0B1EBBA2 3FF32FA00FDBC200 8D13F1DABC0AF1DB 9CFED409A7DFF536 2F8B62434E3F33E0 438AF5CC76D0DAA4 23AD0FCCF8EE84F1 0FA74B8C8221B7FC CD05AE57594A02AB E2B98079D18DF6A3 570B7AC33DD243BB E687D951BF765443 06881A3DCF0366D2 CCE978DF513A3CA5 F6B88EA497B23EA0 4911CA9982B82F2D 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f3b04338-817f-8a67-8fa9-e1497af5846a
  2 22561a54-8f94-83be-be79-976a7e5b96a7
  3 60152711-b0d4-62be-93e4-24aa48e6f716
  4 aeee7f78-dea6-3524-a9d8-536d33339925
  5 acb7d727-6506-25f3-b4eb-6e61508ba3b6
  6 93bec3db-4c4e-7e0b-987b-7df7fc46cb76
  7 83934ff6-3734-2d27-8624-067f421342e4
  8 dcab30d6-bfb0-2aa3-aa41-8c218da695e2
  9 d475ad95-f860-7bb3-9fd8-62f1d5551a48

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 886327227. Exactly this sequence comes out of new Random(791).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 4 of Run 5 (seed 659,062,118): new Random(659062118), Next(8,24) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related