201206270755 vnof0

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 101

Metadata

Post ID: vnof0
Title: 201206270755 → 2012-06-27 07:55 on A858's clock
Posted (UTC): 2012-06-26 23:53:42
Timezone: UTC+8 · title 07:55 against posted 23:53 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(101).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 9 · predicted N = 12 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

EF34D44F2C1EC381 325A499A507950DB B97D3C12B8990D75 DA9868041592BE7D B4DAADB796CE95F9 ED695B621D9F21E7 98E9653EFE2D1694 ADD399636111CD09 2E807DED1B7DD6B5 20E0E8B1912C3495 A2AF799077CF0C4F 2B6303D7E1F15E27 5EF34D25482C31A5 6B3E8C188DB1AE24 E88D5A36A071E394 7E8253EB78E1883E 2DCAE8CD51E6D816 980303747698923C 22FB72C9D0C3E166 982CC85B9BF59F7B 6A5611B57A0D9732 ADD9B74D12E212D3 CA9004B2429EF84A ED36FE2C5960F93A 94569924887254C6 86319E8AD905532E 92FECBB116002D78 F0C81BBCAD09F7DF F02768B3FF3E98E8 F88897EA90715277 1C0385181B0BFF8F 0E35025D0194A9D6 B0EED5D7FE2B5016 65529D83743289B7 239AE37E51A0DEB1 91EC23F5096CF939 753E324379DE75EE 11A05DDC9884B974 2FB22C401C64E9CE AC11C8520846DD7C 8D4100179466BB52 302F31E82E41BCB2 52F20B0EB25E9E08 ED68BC560BD38561 B9778642C194AE9D AB4E122FD7CB71D1 0862A06DC7D67533 EE1403EB61D0CA73 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 07fe625c-0436-4df5-aee4-1cf72b39b06e
  2 deeddff6-b47d-4b36-86d0-8f04e6251be7
  3 69bc01d0-b5f8-394a-a58b-49fefd689cae
  4 f017dfb3-3907-1e44-9211-5fb263592ca0
  5 97f9bd4a-b99f-7e97-ae5e-35464f5ca92a
  6 b67e3fcf-d5a7-7762-a055-ad3dc18b50c8
  7 d41d7b84-946b-17d8-b415-15135219e8e8
  8 5daa2477-6f14-1ee3-9f81-41c31c1fd5c9
  9 20a17f2f-a808-42b8-b238-513230a6922a
 10 4cc8206c-e3a7-47a3-b447-982e5eefd6e1
 11 e6047da9-4d2a-6b62-8195-7c5617609b8d
 12 2a198d64-c2f5-2016-a138-3a9870855537

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 443177114462. Exactly this sequence comes out of new Random(101).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 9 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related