201206270652 vnkxb

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 914

Metadata

Post ID: vnkxb
Title: 201206270652 → 2012-06-27 06:52 on A858's clock
Posted (UTC): 2012-06-26 22:51:14
Timezone: UTC+8 · title 06:52 against posted 22:51 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(914).Next(9) ✓ verified
Run: Run 5 (seed 659,062,118) (seed)
Draw: 20 · predicted N = 10 ✓
Machine boot: F 2012-05-15 19:11–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

13300D909F44D48E 46C807AE78C3AA7F 5EB70B96597DA00F 7C6D09B6E8388AF4 CF6F571C1C1CE991 E18E6DFF02ED5BD7 6FA530BD9586ACE5 8D514A115B425390 0105C28F1042D7F9 1D25CEB834C86237 D1689DA7074A62B0 3D509EB9F6509154 9067E940A8947171 65296A5F0B628467 AB9B73814B8BBA4F 3D29AE49FC58B8A9 7C5F6ADCA05193E4 FFDE6358763CC120 D792A96C2A96F8BE C8343F66B0D92F0C 623C08E85EB3FEF8 C3EF2EC71E881EB9 8E169A137B0C3797 238929AB5174B1C7 C966EDF3749DC7DB C0FC058A09C3D87A 1602F9F86F0936C3 EA3C5F47FA307C87 2DAA53ADBD8D68B8 0E8FCEAB31317A6B A068FB0EFC5BBFF8 544066F2DC1E9B20 EC347CE22C93AC18 31B9394458EB0304 DF075DF476C3281D 628DD0E2DC6BBF31 D5620BF4D0CCDABF FE1489C626C14CC5 775BBB989AEE4E88 883C10D3101F5187 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 296f0a91-f9a1-2ef0-9c2a-6081b32ca102
  2 c86c29cf-5b1f-09c7-9956-df023a77a781
  3 3b634570-c9d7-5ce7-ae5e-0a977ec21e5e
  4 1cf9f902-7bfd-50c9-aea8-72645856c0e8
  5 3cc6ccb7-cd5c-75a0-b2bb-1fab19db0d56
  6 8d9b1c69-4410-28fd-a761-0e864205fb57
  7 8e33ec3f-8355-3366-87c2-ba313f7cd1c7
  8 8dd7c0af-461f-8f03-a191-c3dbe7e6587c
  9 ee9d9bc0-cf9d-0d84-9315-e72090f6c632
 10 1e026c1c-8aad-21d4-b08a-5357d995ab16

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2055723802. Exactly this sequence comes out of new Random(914).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 20 of Run 5 (seed 659,062,118): new Random(659062118), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related