201206271025 vnx1o

explained decrypted filler

3DES(name) ECB, 16 GUIDs, seed 696

Metadata

Post ID: vnx1o
Title: 201206271025 → 2012-06-27 10:25 on A858's clock
Posted (UTC): 2012-06-27 02:24:04
Timezone: UTC+8 · title 10:25 against posted 02:24 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 16
Filler GUID seed: new Random(696).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 24 · predicted N = 16 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

2310DDA955655FAE 4EE64BD378BC7724 7FB1AFA69CBB6EA3 682A15B0F111B080 241B06FC575F215A 155090F28F8EA6CD 847A3C401A0B8C70 8349D6710C3A55DA 5F27DD1EB4A1D2E9 5236B5D1F683558D EDCE534EBD752896 003FD52F9EA6E7C3 4A611127635C803A 450AD9CEEDDCD7CE F8445857863C1A7C 8CEEE6613B4E45D2 28DFAF59B641FB83 4FA5889F9A877530 C35717AB6598170C E37BC71242C4AFF6 812214B2124AF053 75CE1813D6F6CD81 6E34D57699A7E530 53E15D8D2AE04783 0490D26A0040B9DC 84B6FBB7493CD111 4491498703F9FFBF 6BC6260FBE94D0A8 0845B2E6D1CFC35B AB82B02756124516 C8E52F4930CF178D 4EB0CA4420785A93 AFF43666C53C6A92 A64732224D7DD204 C7323F24BB6E4210 71FFB8BE475BCD37 FF049E9FBF5EEC18 C365B77E30037072 EAA79AA9E15802F6 64CA40671B7E84E8 61C97DC449812FAF 1A6629BB922551E3 2ED28D49AA30AFC2 105C85CD908594A2 057356C1568B5EE9 22CBA302C9A500EA 444BDC3D4108FB14 F7BBE05770B7D560 A2A3B186583176B4 A92696C97DD80C6B 0CE40E4DD79558B8 FCE2F90C701654F5 2BABAF54ED1C1914 4E2DEE9E11D3060F 40AAFAF01BD0DA1E 422F87A0F837FE0D CE0714E5BB6F6FF9 3DA3DC7CF70B2720 71E84DCB22FB0B01 03A262A430E4C4CF CE70D3ACA2E7B164 7BDC9640B5527B06 4805323C7E05E208 4143BBEAE0BC959A 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9f66c127-02a1-3883-b529-191866cdc6fb
  2 cd72c91a-9318-043c-83b1-e1e1f281d8da
  3 12b44dba-3c6d-25b5-9a90-af1778cc6676
  4 e9defdae-88cf-10a8-8572-56d75164e8ac
  5 20aa8b54-c747-3f88-aaae-4c422e1bda76
  6 b7f2d8aa-9af4-7a57-b270-6c04285df191
  7 4eeb764d-c143-6226-b1c6-f46c3b9304f3
  8 a520572f-cb67-5266-ad8b-e78e4da4202c
  9 a2ef85f7-d05e-07f4-829a-dfec39a8a15c
 10 b0f354c1-629e-8ce0-82ae-df8c8d5445d7
 11 afb67d28-c0af-05e4-9e7f-0277678a1ed4
 12 469c58d2-e0a1-7423-ba21-15f8c5bf02f7
 13 36bacea4-b082-006f-af58-1e205b545b9f
 14 730e40e2-eccc-5bbc-9f7c-26340be642e0
 15 9faefa7a-99f7-15f1-b2da-9ce7b618b2d9
 16 83f3f735-b553-6b8b-9af0-cde685e6aa57

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3021376508070516. Exactly this sequence comes out of new Random(696).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 24 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related