201206270945 vnul0

explained decrypted filler

3DES(name) ECB, 8 GUIDs, seed 148

Metadata

Post ID: vnul0
Title: 201206270945 → 2012-06-27 09:45 on A858's clock
Posted (UTC): 2012-06-27 01:43:59
Timezone: UTC+8 · title 09:45 against posted 01:43 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(148).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 20 · predicted N = 8 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

8F64EB84C9225088 9337057F30B8060C 3A57754954B9B77C BDEBD6EACA7503B0 2EA5DA9A255A4083 4DD18833243BCD8D 041760058ACA6084 F97D47A2D39035E4 6E160DDC86A1FC6F 0DC9561F0D0C3218 423E4E1E2F18189C 74DE129ED359649F C77887E3B8CC4403 862A7B53046673C4 12BEF1E1492513E5 B713604A7E1E5C81 7AA3792B67CED66F 300F09B6A2463F0D 7B58E441B5E4F7AC 5D61662DED5DD2CB BBF0BAEC4E214462 A99D335D358173F9 B82EF1D2DE45DB9B 8B9B5F0302D28627 20A596E99C57400E 8C92274711D48CD2 4A04E068AC2F09AA 8DBB5B45B60985E7 AE47C5045EADA818 17A4D957CA414A8A CF410367C4AEA398 4C2FA96A717509A8 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2f650cd1-edff-003f-bcf4-01f5abed8e17
  2 8d514ad6-258f-2128-a0c7-c942e22146b8
  3 515016d2-3053-1268-9855-89f97039836f
  4 be48a943-05c2-1137-8e82-a0b50fed65aa
  5 cf3de37a-ac0c-05c5-bef7-f879a517bfa1
  6 80326876-2fc8-87fa-a415-b7fc6ca051c6
  7 57793d83-db4c-1e4d-a403-c34fdab1935e
  8 92319619-3120-6d88-9884-a8a1da19226e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 02110816. Exactly this sequence comes out of new Random(148).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 20 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related