201206270622 vnj3l

explained decrypted filler

3DES(name) ECB, 18 GUIDs, seed 835

Metadata

Post ID: vnj3l
Title: 201206270622 → 2012-06-27 06:22 on A858's clock
Posted (UTC): 2012-06-26 22:21:00
Timezone: UTC+8 · title 06:22 against posted 22:21 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(835).Next(9) ✓ verified
Run: Run 5 (seed 659,062,118) (seed)
Draw: 17 · predicted N = 18 ✓
Machine boot: F 2012-05-15 19:11–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 2
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

467B77DD846D8074 A9611A16BC6B1ECE 435447EB3B472A3C C1AF66A4C19B75C7 CD8A6D21EF9E55AE F7818358C9C6C6F5 40124409D518FB22 61E50F3730703E05 CC62E745ED46F2C2 1486E5638B66C2CE C693B277073AB65F 363A9060AC84755C AFD3ED367BC0DE56 D4FD66165098065C FF992C0B5838CA03 B23C8A39CB2747BB 3B56E3ED415E2073 522F6A4DDDFD050A 8221B3A77ADD796A A896E3BAECCEEF13 2E1911E06439D958 F084B7D449AB64B7 09CF5BD3DC2E3CD2 8374CBA1616E393A 643D5997414FA24F 8FDACD98688B51C2 933D317FC522F607 57C170AF9BFC0206 D7457D5494B3E520 65B2F06342998B0B E4A74E9B45180CB0 85DED71A28738E88 08AAB0F9003F2FF7 7B4006B8015EE7AA 0CEB7F8594DE6A84 D85E168DBA33549F BF097972D0AB643B 7FF6E2326B2104E8 A8ACA2510590579B 4D84C589BC92070D FB8153187FA8D31E 7366A56EC705AD84 092694BB59AF5E1A 3F59DB38CB008444 484D32492B43F79D 1986FF7258606609 917E3C2AA6E6A1C3 35FF100CDB611CF8 D9C89F0C4C2DCA10 0E2A8B0C9FF56ACE CE89A595F2EFD9C4 9FEAF279BEA8CF25 9FC9C19299270D04 50DAD10918C7DB8C DEE297546F14BB37 BC11DA65860D109B D841CD209F329ECE BDFA452F1D115BAA B8D9718EA40819C6 540D0A8B79F3BD98 6196BA9095BC2355 A1850FC19E6C545F F2D7965237262805 BAB95A9C81EE2CA4 D6E53F17D0427E07 1A0F06CE293BA445 C479216530CF70CF 2603144284A80F89 4BAE85FB119A0353 8A6955D1B06D477B AEF5498551122E3E 9D0AFA75AA2B727C 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 97a84d93-b733-8529-b6b7-7e876ed11f56
  2 2cda4cdd-3bb3-7bdf-8eca-9962076159a9
  3 2258a92b-0845-3844-8849-5eaccf86cae2
  4 0f87c2de-7906-7493-8e1c-39509cbfe662
  5 858401df-6c24-1070-9816-681584bc8aa9
  6 6239ada9-fc95-23b6-ae93-9a97f131e3df
  7 ce0632ef-c04b-05be-bb13-882ce4f49a35
  8 0c9b77df-28f5-3d6e-b78a-dfd33f742be6
  9 9b4e8cd5-0a04-2829-93cb-7111420feb58
 10 d57ca73a-a1e2-194a-8599-16bf4a4ee209
 11 a8963d06-6516-489c-b8bd-6b273e936df7
 12 e5668d0d-32d1-36e7-811e-d7f41bda19dd
 13 0bdf3c86-0760-532a-92cb-47e8c45df3ae
 14 9dfe2c0f-d717-766c-88ea-dd6695148693
 15 2a5c811c-a98b-4b78-ba3f-c096c17d537c
 16 acd27221-69d8-42ae-8158-44ef8b6c877d
 17 fdb88fc3-3a86-7183-858e-78e5dcdf68d0
 18 1165a4d6-4c70-625d-813b-63700082cf2b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 873712032143574476. Exactly this sequence comes out of new Random(835).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 17 of Run 5 (seed 659,062,118): new Random(659062118), Next(8,24) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related