201206270552 vnh7x

explained decrypted filler

3DES(name) ECB, 13 GUIDs, seed 335

Metadata

Post ID: vnh7x
Title: 201206270552 → 2012-06-27 05:52 on A858's clock
Posted (UTC): 2012-06-26 21:50:55
Timezone: UTC+8 · title 05:52 against posted 21:50 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(335).Next(9) ✓ verified
Run: Run 5 (seed 659,062,118) (seed)
Draw: 14 · predicted N = 13 ✓
Machine boot: F 2012-05-15 19:11–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

DE2FD01509FBC6B1 DCFE10F71DE4A353 48C3C2BC64F5D488 E3DD36AFF7F52961 41ACE151366A926B E6F238215B8DD6AA 242EB9EF9EC85016 9E7D74037875B2EE 83F15095742D844A A480F09AE18552BE 8C003064F4D848F5 F6CE4A36A9B9F615 37D7A23E186CD89A CDCFE4C35294BB60 7D67E0C3DA19EA4A 26DC2B641F741377 04D4F1E42EB71DA2 18C723FA93E199E0 F5C90CEC4C001BC4 2009C7DB2A22D01C F5EF661AC999C663 1986D0C6ADEA1236 6A8B607E5410D49E 969005C9686CF9A8 04B99B21FE5D8237 DA6AAEE6B884E775 4934CD3175FF489D 200FB6B139CE252E E45477BCAED09CCB 405559EECE2AAC28 59D597003813308F E7D19D97AC97A321 2C4ED99B27B6F670 ED64332DD71DDBF2 D73FC86DB398CE2D EE9A008E878D2D04 20A0445CDE717D34 2B50704BF84DE236 C22C7649E3EEAFD6 674C93F891ACC329 81B14E609EAAAB8E C8AD9F0C9E4C0850 057A1CC61538246A 873ED59065AD1294 26C58130DE353AA5 9440F8F758F5FE95 A560BBEE77020004 573FD6CA43D23E7C 718303BA17AACE7F FD2702AF2625EB03 795D04B050053E0D AFDC7E6DEA067DC9 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b8888751-bd1a-6223-b088-11a257054471
  2 4407a525-6f54-18a8-a8d8-2d6a3f22cf35
  3 8b9ffb1f-e788-83e5-bf55-4ac424477cf4
  4 12bf2501-52aa-04b2-a915-ef12e26a2911
  5 49894f07-1e90-4863-ad3b-f090b292ebab
  6 fb34d454-1ffd-2a49-a9de-10d68f09d271
  7 61a31d3e-07a2-025f-a83c-1298b5156022
  8 011daf04-a86b-4d10-a804-2e24d4bb14b7
  9 e3d7d263-84fb-32a2-8fd0-4c1389f89662
 10 c85af8e1-bbe6-7406-a371-a06de0dfebbd
 11 4fa7432c-a7e2-0762-85e1-d136932d3ec8
 12 5e360141-d007-0c58-93ad-64c6e8576a5d
 13 fc554382-77ab-8548-ba94-638221196e92

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6180420437008. Exactly this sequence comes out of new Random(335).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 14 of Run 5 (seed 659,062,118): new Random(659062118), Next(8,24) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related