201206270530 vnfv9

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 586

Metadata

Post ID: vnfv9
Title: 201206270530 → 2012-06-27 05:30 on A858's clock
Posted (UTC): 2012-06-26 21:29:16
Timezone: UTC+8 · title 05:30 against posted 21:29 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(586).Next(9) ✓ verified
Run: Run 5 (seed 659,062,118) (seed)
Draw: 11 · predicted N = 12 ✓
Machine boot: F 2012-05-15 19:11–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

3F3AF0AF2A3148A9 CD87B394EE5E909F 79DE3ADE764205E8 73247253258517F8 35380EC3BAB34372 C54BDAF290D2EF13 E88B84B1C87010D4 54FB28EC73CA568E A694B4BB4F81900E 342BFF04707CA059 A4911B3AF44DA869 5178C46B7296E0BE 9457936A4BC2B8EF C6179F6E68684236 9FFB0ED53406486C 0F149E4A71E6FB56 1871EF45E0A7383F 3CA0A67A92164EA7 34E6940F1466F67E F136CC9C2A46E8C0 31186B42B7B2BB39 917551EAEDC631C5 89A1CB7997F19449 64F90607015C4B1F D538000851F12F5B EB81154501B8E0D1 303266C7F3D2B135 58E2B4554384FE3A 68F7CFCAB25D53F3 F099EEFD265DC9ED D7702F293D3FF6B4 68B452C2FE39B41F 31C0B7BE15C1E879 87466A97BCF4E532 8532659A518AC723 5F596F9DD6525F04 0FBB4F8438D07445 CC0DCDC263C87366 6E9F2DBD77553BBF 0A9DADA3625453B8 54E46C02EE5B3B5B CE30DA7CCA918EDE 3F88EE91221CAFF0 56F689F5395BD57F 6CFDD68849064162 EB632A4BE8EF87FC BEB751FE1AA3E35E D6C3B3E01C059C45 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 130f78bc-6f27-7e36-bad2-342e6d7a3c12
  2 88da1dbc-1667-6521-8bbc-ae37aaed0ca4
  3 a3e4b92a-5c32-3376-a55f-746ab691a414
  4 974d50ff-c7a5-57d1-824f-468e90ac4b50
  5 12eac81d-2597-614e-8184-9a6059376ff9
  6 d4c02f5e-c999-5f2b-a7ec-5e129f1ae832
  7 b46c68d6-7e8c-4688-bdba-fe68378103fd
  8 1593eac9-006a-38a0-af6e-13e3972b443d
  9 acb5d3f7-e3cc-4f2f-9b7a-b6bd899a1f56
 10 3231d047-8e1f-3d4b-a9d3-59ea685dc388
 11 269516b6-c3fc-07f2-a464-cdfc5c5b01f9
 12 ad9e426f-7a49-8bcb-8fe2-f0fbfd1b59ee

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 763565434308. Exactly this sequence comes out of new Random(586).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 11 of Run 5 (seed 659,062,118): new Random(659062118), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related