201206270542 vnglh

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 964

Metadata

Post ID: vnglh
Title: 201206270542 → 2012-06-27 05:42 on A858's clock
Posted (UTC): 2012-06-26 21:40:53
Timezone: UTC+8 · title 05:42 against posted 21:40 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(964).Next(9) ✓ verified
Run: Run 5 (seed 659,062,118) (seed)
Draw: 13 · predicted N = 10 ✓
Machine boot: F 2012-05-15 19:11–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

BAC901B4E9FF8542 7F19CE5D502F1301 01E70F05DC8F53B9 7A47DA4A05BA9571 B9197E5357CDEFAB 95A1DAC4EE4E6E8D 3070A1D589D7D5D3 15F1EEDF6E74429E 1DDFD0D7F262E2F8 E09C080E7AA611A8 4481AB14EFA259DA 07E9882276CC77F5 2A42A798511D0097 1ADDE3F1DE9F3240 096D8DF2D942EB3C 2F4E4EDB2E11B9E4 8CAAC8975BF5331E 5D7F5B419E8DB54F 64E894B138FA44D7 B07DBA57E6F61CF9 E35D253B4394597F FC37E39D4A5269B2 ABD05262376E6F1E 418BACA0E31637F0 B8B8430635B459A2 3B726E7014D34BF9 66AD6488EE27E762 61E6FDAFB2729917 C0220D3E161B0966 AB64CE93F6439981 4212D1DB2C41F29F FD82A22BDD362EED B4D3C0311128575F DBED8F7A8A5EEB3D F1A5B05E4D3AD771 70D4CFBA7A7228F9 E52380D88D7A7CAD A3D466756A99C2B3 46338EC4DA2FD097 3487DD23CA1973C9 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 09f70552-7664-334d-9dc4-b678d5d164b5
  2 d7bd959f-9726-6e0c-9cce-c777624d71dd
  3 1a1db900-1281-505b-b45a-5a9e1529f138
  4 9efd3a0d-e0bb-2ef9-acc0-db324a4cc199
  5 f2047955-cad0-3226-8224-0129056e583a
  6 1b59f676-80a8-8ebe-9ba0-8b16a132987a
  7 14bdf7a7-2a9e-7437-bb48-112dcdac9b74
  8 415f7f98-e216-02b8-8741-d2e3d884b567
  9 d732e350-3e31-2f7c-bced-2377eb4e9d97
 10 67b6974e-970e-611b-90ef-622a43f88573

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3652387026. Exactly this sequence comes out of new Random(964).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 13 of Run 5 (seed 659,062,118): new Random(659062118), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related