201206270745 vnnvb

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 583

Metadata

Post ID: vnnvb
Title: 201206270745 → 2012-06-27 07:45 on A858's clock
Posted (UTC): 2012-06-26 23:43:41
Timezone: UTC+8 · title 07:45 against posted 23:43 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(583).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 8 · predicted N = 12 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

65AB227BBD520F13 684D799A025DA4E9 0F2AE07AC270A2A1 729BE905AE8646EB FDD2D5C3A61EF1DB 2B1F1BE2EF6CF915 BE5A12C17B056CF9 86792F11151D8C55 D398F1CCF2538CC1 CFD89F2475533CB6 E00442EF6FC4139E 1E453D254EC99279 EE9C0E26991EC70F EE43C45B37B62CBA F2FBFA61DB987B6D 08E95D5DF5DBD2F9 A83EE7DDBA37B5DB 41AC4C8691FE93BA ECA2E9E9F101F0A1 10181DDFF4F0C8C7 15C495C4ADC8426E 743B8CB521E2D558 6CBB9B36BAD0EA91 A2C7B3A5924A0944 BD6193B7906EF916 FF43EF3ECB67B41E 815C757A0655FD21 E25B8435C00417C5 172B2A6184E5E905 CA26D863CCCB7ED2 D9D3A8FFEEA1AA6D 973B61D47EA4E9F0 668EF79771D96288 514457331D47A44E 7CD04A21A36EBD45 12F4BA04269BFE7A B981614858625D4E 03E8C8EDB325D432 4756D48CD39B049A EA1082CC59D542FB AF6A8262A5A3AD56 E38D4633F0E52069 9E5155E6F9637FAE 55E0D2B6E2824A15 EB2581B5D32C911F 11A956D8A3A7EA82 8D34067A126D4E57 5922405B47DBBCF9 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 aa5ab18f-f4a7-2fdd-8d23-28af0fcb0c2f
  2 1e9e1d39-2c18-7c45-bd52-8968c5f2bae2
  3 bb2d372d-8549-2a64-a147-9742c23010d9
  4 d8ed613c-9438-880f-acbb-546ca7a3fddd
  5 7830641a-0ed3-3898-a11d-d96be585dae3
  6 79fb43c9-ab7a-0303-b6be-9e696823cb3c
  7 47a8c788-146c-1219-9ab0-f7408b6bd9af
  8 55165cd5-5bb4-8ad1-9426-da3ee66a3ff2
  9 c6736b77-af18-0d0c-baad-b80b6feabdf6
 10 4939aff6-4cc2-2b92-9791-6f71027c13b6
 11 397fec19-13d2-7f48-83aa-dab7475d1fc8
 12 3d08f5fa-b608-589a-8e17-474366a047f1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 272830180275. Exactly this sequence comes out of new Random(583).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 8 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related