201206270905 vnsbn

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 507

Metadata

Post ID: vnsbn
Title: 201206270905 → 2012-06-27 09:05 on A858's clock
Posted (UTC): 2012-06-27 01:03:54
Timezone: UTC+8 · title 09:05 against posted 01:03 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(507).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 16 · predicted N = 10 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

046EB603D64CCD01 AC0610119C229EEE F2EE89E52FA32E28 F603C9AD45ABD876 363F323EF394B735 1063413C377A91E5 76BE4854451FE4A2 FB8C81EC3E9B59E6 DA67E26D29703BBF 5D343A342D60376B 8D59F212BC235102 AC683A048AB05C6B 6D11821D3A7CEDC7 39DD8FFF6AABAFC4 86F3E56D4E6ED1F4 F0F81635ED1CB588 15CE3FD040010C18 1315B617F3EBDE22 1F9FAE0CACDC8D52 4A13E83959F78310 99CC2C274DB7DCBD 66188124F8EB45A8 7C365C47C15A0DA9 AB4C49705BFF55AE 8237A430B9718C6C 916A3F44C78372BD ED5D18D761DCF1B4 087555C0B04A3490 68BF5F66FD11742F A8E1E126CAD6D93A 7DCEC92B4C673217 592F2CF21DBFE946 0A2BA31EA3E5737E 348765606CFB24F0 EE99D2C96D752EB7 C0B37A9DBB8C6005 F8A0912812F07ADA C35285449842DEBE E477E09D106104BF 171DF6F68380206E 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f54afa50-e532-56ef-ab4e-1e7b3d4bbe9f
  2 fc7208b3-1d51-5fde-9a24-125f81fa7bfa
  3 cd312c20-be2a-13a8-a378-ac8d2847c971
  4 04817d91-4b08-6127-9470-be08c5589151
  5 9f4ae083-a9c4-0ad7-9f81-0b9eded09f07
  6 98473a38-9065-5bae-9c9e-f43bb9135994
  7 7c99aa7d-9ea3-03fc-8e22-57de4647827a
  8 d25046ed-fe9d-781e-88f8-d01d576d7eb1
  9 6ed97796-a84b-662c-890b-13cdbcf8ea2c
 10 56d3429b-78ba-2a57-ac49-6618996ccfef

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5516050762. Exactly this sequence comes out of new Random(507).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 16 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related