201206271005 vnvsx

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 326

Metadata

Post ID: vnvsx
Title: 201206271005 → 2012-06-27 10:05 on A858's clock
Posted (UTC): 2012-06-27 02:04:02
Timezone: UTC+8 · title 10:05 against posted 02:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(326).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 22 · predicted N = 10 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

71301AF0E298486C 718169F336AE554E F034B765561F2F7B 91FE51A2E01A98DA B5657A6E2B1521CD F92C0A545F889074 CA06461DBB579B24 A7BC63400CF0F8A1 184B7C7707D59A20 80EEB7747A1B09A5 7D13991ACCA404AA 4C7CB1C5A5724A76 C995736303590236 C1186C1CB1A562AE B364B2C77C1D419F 1F11FAB44557C3AD 3B22697B32BCDF45 1BA37824B24A4F9B 7FD1096714F31F4F 36704FE90BEBF69F DEECAA61668B4A0E BCA301CE3457EE6C 9427B00D60F75AAC 7B79C4959892B95A 453088348E41B76A 49F301843B53281A F53B4A317835B20D 45FED4F72F5B355B 3F071FF91E346B87 D029CF133C0A1E5B CCA5EB554FC4CCF4 1817D1243FF6DCBB CABD166C466D3A44 0DA00D81D95BA5CF 8146726101794C28 52CF3CC765AFCA98 8D39FA9256C2D429 C5AEA769883309CB 4CA0F9288B4F40B6 DDE22D8A8FC1764D 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 afc147e2-253f-0483-a31a-4c10f06db2e1
  2 58ffe6b9-0957-45df-9fec-6516c6ec589a
  3 a5a24f6b-9ddd-5313-b2da-3ecc79f41976
  4 dfd6f26e-0acb-1be1-a586-c6e0abd61198
  5 ebed3c71-c190-37c7-8e20-9d529d341507
  6 d3e0cb93-aaff-4490-9144-679d3aaf3de0
  7 3a7f92c3-a84f-88e5-853c-0f46d14643f8
  8 378186c8-f5bb-89d6-9f8e-5af8572e604c
  9 43d2b668-5f18-2b32-b938-434b07908a13
 10 2b14920b-cd24-4460-8021-6da5e885d935

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0451348824. Exactly this sequence comes out of new Random(326).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 22 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related