201206270529 vnfrn

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 519

Metadata

Post ID: vnfrn
Title: 201206270529 → 2012-06-27 05:29 on A858's clock
Posted (UTC): 2012-06-26 21:27:40
Timezone: UTC+8 · title 05:29 against posted 21:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(519).Next(9) ✓ verified
Run: Run 5 (seed 659,062,118) (seed)
Draw: 10 · predicted N = 14 ✓
Machine boot: F 2012-05-15 19:11–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

628831ACB0FFCBB8 613F1EFE20F5372E 8F5E26562C959A10 CA74D9AFEDFF41F7 3E9231F10D6031E6 A00F9B6356FAD270 25597F7EAB04AF60 AE21FA6ADDE81067 C32409A36056A63E 71E26655D33F50B3 F575E87137140555 5E651CE201669A11 9D41FB8F7BBD38CD B5C20764C7D8E679 92B9A8DAA89FC3DE 857AE7157E67A89C 97680871F3CC32D0 CFF90CB41BCAFE5E 1B5A5EE3F507FF28 F92F5490C53B1ACB 7D278A78B8702688 A9D648278DAD1411 6469DB4116BD5E43 9302A47AF3317BE4 A95B24BF5E5028A2 78F3D42C60AD7393 9049BCCE4A6C6533 EC7829BCB9549DD3 091225AF6F3839B2 56EB62F5A9872F73 D9815E3FFC352EBB BFED87E9523205F2 BAE4EE75ACA57BFA 60AE87B75B4E1B60 DD4FDD44C1F0CF4C 445BE55D9BF143D5 6D192F02952DC856 DE23472F1DEBFFF0 63180EE88E0D8991 12578276CFDAF1CF 5E5ECC315846D3ED 9034F2E474534D06 9BF710D7D5384C2F 3A60614E785E2E7A 0EAD92492DE87A6D 66DB354E0CA13FF3 5D5A3C5ABBC1F79E DE543810CCD70D7F 59AB7A725ECA66D5 A58E3431BAF7AB20 4F60DD713DCEF312 1314E580A7896422 7D688220EA662781 E7AB2537CD708A9A 85025BA0B732AB00 37CEA8E7B688D373 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 53b712aa-7b31-76c0-84bd-ee2647950187
  2 ec240484-8fc2-0601-aa84-de0b401fca89
  3 3bc707a2-5489-4659-b2fd-2df0e12cabfd
  4 5a6a2673-6815-3e30-97a5-9a2ac7e1873a
  5 47d787f1-cbf0-428c-acef-223a274b2a78
  6 a23719c6-fa4b-1244-9927-ab168273dba9
  7 5c99a4fa-e236-4333-823a-1264dd8c7838
  8 49e086d8-fd6c-716e-8409-485d00d9dfd9
  9 042e538e-38fc-178d-82d3-4bb7429273e8
 10 68300664-0222-5212-9944-d0ef0f3eb976
 11 71ae9b18-365e-5cc3-9d16-2899b1e9ed9c
 12 bc25e352-444f-5f7c-9574-7a00933d3f39
 13 4781bcf1-f75f-30de-b89b-6bf60cf83286
 14 8ea70627-0baa-4608-a4cd-4512ed5f5a0b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 70434147155534. Exactly this sequence comes out of new Random(519).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 5 (seed 659,062,118): new Random(659062118), Next(8,24) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related