201206271045 vny9a

explained decrypted filler

3DES(name) ECB, 9 GUIDs, seed 940

Metadata

Post ID: vny9a
Title: 201206271045 → 2012-06-27 10:45 on A858's clock
Posted (UTC): 2012-06-27 02:44:07
Timezone: UTC+8 · title 10:45 against posted 02:44 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(940).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 26 · predicted N = 9 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

875CF8CDA72CCBBE BDD15B642517D86D E5316F3B5E0B9FFD 17CCC7CF001263B7 EDBD0D07EB07FC4F AF56591FBAC77991 28473A125425B085 44245387C8294C1E 15C31D993FDD1182 C9A7DED285B0EC9A FEE7C15BE5BCBDC1 1CF610A76F324C93 79A6EE13955121C8 971AF76B388FD8D2 AE3405EA6900F63A DD78A6C2763970CD 6285783C5BF56396 C1123C0C18395DAA 0FDAC78519A007BA AA5530CAC84E2209 826885658D79D4BC 10A6255DB583E05E A537E260E231469C C333BA31467D62F6 152C9A8FFCBF6C6B FCE845239110537C FA58D35C004F135F 57585FDB80836055 2EF0A4F855474637 4C0FC4D39DD1C40B 3811E6BCB3E24DFD 8DE2E5D9AB48FE22 14EDA811C7C91847 C7FFB20F820C9BCF 43C7EBDFD4515855 4C805B42AE910E57 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8c0b72be-5b26-79ad-8f39-6c8df5c0e262
  2 72dd0d54-7278-56a7-b249-df5477f0da32
  3 3722f9c5-59ee-7019-b1c7-4747192dcf2b
  4 f689d26d-0ed6-1e8e-aeb0-462d85d9290c
  5 3dea7cdd-6905-5afe-a57f-cb54f7bec087
  6 f87bd0cb-206a-0c24-b24d-cdc5eead1cea
  7 2bfda705-bba9-03f0-a070-4534207ddc7d
  8 c46e3c42-52e4-0208-bbc0-509bfa08a754
  9 7488f216-017a-201c-ac65-ec3148d26e5c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 757150002. Exactly this sequence comes out of new Random(940).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 26 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related