201206270522 vnfd0

explained decrypted filler

3DES(name) ECB, 8 GUIDs, seed 161

Metadata

Post ID: vnfd0
Title: 201206270522 → 2012-06-27 05:22 on A858's clock
Posted (UTC): 2012-06-26 21:21:15
Timezone: UTC+8 · title 05:22 against posted 21:21 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(161).Next(9) ✓ verified
Run: Run 5 (seed 659,062,118) (seed)
Draw: 6 · predicted N = 8 ✓
Machine boot: F 2012-05-15 19:11–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

A29C14E59C3F0E61 5B44627580E7C4E3 9CE067AA5881852C E249E289F91EE8BE C2B1274B5BDE4D35 6D4F52D0446DCA27 55A49C82DC3A132C 507E0716837232EF F0396B14D63B493F D79C495004E372A4 E7AF2CDCBE3004AA FF7DD3D427F2F0C3 CC7D015E8E862570 C37BA877D81217A8 8022DC42D84AC08F 00507E654FAFE0F7 DA745623BEFE6DAA 4E2F728E02E9C440 481AF5378763A579 3361CA34A4CB87AC F2868BE475910759 4F57BDF718B45CB4 160C41E5DCD78964 7D26BA6CAEFF0715 668B8DDBF81F39E0 ED454F2C498FE5B7 0CB6777DB67742B9 E1D52A2654349457 C115D98231D3B6CD EB02281483174235 B1D327F3BC3C5B5A DB7815544D52B851 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c3a90997-7d69-7139-a047-69f0cd44f555
  2 acf03919-e47b-0d60-b3fc-1c0ca362d55a
  3 97ba8266-64eb-2dae-83aa-f68df2a384e6
  4 a7eb8ec8-e15a-8730-a84e-0d0ee35f6094
  5 ad2f643c-e287-8bca-b461-485ba0863b3e
  6 b6746084-0263-29e7-a09c-f98ff7b0bd0d
  7 87b20596-ec2f-0dfc-855a-bf46c1cad66c
  8 acfceaff-ebe1-19f0-b239-fae7c748bd77

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 70288201. Exactly this sequence comes out of new Random(161).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 6 of Run 5 (seed 659,062,118): new Random(659062118), Next(8,24) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related