201206271105 vnzfj

explained decrypted filler

3DES(name) ECB, 9 GUIDs, seed 466

Metadata

Post ID: vnzfj
Title: 201206271105 → 2012-06-27 11:05 on A858's clock
Posted (UTC): 2012-06-27 03:04:10
Timezone: UTC+8 · title 11:05 against posted 03:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(466).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 28 · predicted N = 9 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

61FCFFBAE0458F9A DE1E9F51293DC447 19D1445763821309 CA7EC93F1BD5534D ACB038D2CCDA9F22 26C45A46271E5CF9 1967942E0E72F4EF A9E0986C1AED9652 22B1039C1FB88EA4 056FE6E613793756 25E4B635C5CC8B06 F0F368ADAF55B6D3 9AECCB0BF324422B F28432F00333A2CA 7CDF8DF297A73998 D8D3712E884D6CA0 9A94A97CB4199065 2673B4631C1F6752 81B85BBBE9A39F0C 847DE061194CE3BD 69B81FF53E1E52A6 DB869A16E394F452 11B09ACCAF0D26FA E89C082140D71F10 264CBF25C0DAB2B8 DF4DD08C11636699 EA0284F3F61A3F45 FD13F5C84BF6D162 2AFEFE3382D3EAEC 431225D8A0873710 D5E39C55E35B0A1A 0BA80A2D20366A0B C9E0B29A9E140FE3 9811EA3E06188306 D15D8CCE4F47A8F1 FA5686E40A4BEF41 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 20afbc45-e858-1c08-977c-ba2aadeb87bd
  2 77b06797-26ac-4ca3-8bf7-bc533219e828
  3 c8485bdc-4b64-42cb-88c7-eeeabbfe5604
  4 a8df7424-630c-04ba-9260-86197359db8f
  5 c4d45219-7816-565b-90a3-2a55f94b024d
  6 2f4d5c96-a633-7141-a23b-cb005365c39a
  7 dd1f60e3-1550-6eae-a930-9b31eac88cb2
  8 740e9ffd-672a-2ef0-b198-fea63a8dabc0
  9 e4f85616-215a-50e3-9374-2adaccc25a47

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 144057625. Exactly this sequence comes out of new Random(466).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 28 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related