201206271125 vo0ho

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 100

Metadata

Post ID: vo0ho
Title: 201206271125 → 2012-06-27 11:25 on A858's clock
Posted (UTC): 2012-06-27 03:24:12
Timezone: UTC+8 · title 11:25 against posted 03:24 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(100).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 30 · predicted N = 10 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

DFD57C461E0EA3F6 4A9EE3908626C293 5F7EF26ECB41C536 A395EE72CB1DE51C 871D34713F82BBDA 8819B515F6F6D647 FB3C3614A576407E D7E59929818053CF 45ABFCB2FED28675 37D0356E3F371F2C D366C0C2373A23A1 37D2BE18345F1A41 9EDDCC932915CC09 72965C54CB57EBBD A40033530976039B 57732B17E50CAFE5 C9768FD244D3541C 4841DAAF91B4DF36 9FC8CEAEFD111A26 8D1EBF9C259CD510 6C9CFC59E3C270EC 0D1E95263285D7ED FCF33ED73603310B 068080CA3B5053EA DB6EA282ECDF9886 0E1C4FA1A637CB25 48E3DF725C72E665 F33B280CCF05CFBB B5BF28FE9CDC44B5 31D5C1FFBDE0E78D AA0289D9DD80FB72 006D1D2176506397 0C7AA80D60E9879C D84A7A86DFB75538 63582E327CDA8415 412BCBA670DAA57F E17183E6F46C641E FA4F6650DD399DBB 4AA32D60077B03CD 72C82FBAFF5E32F7 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3ba7273c-e1fe-84f0-8b0b-8174d749cb7d
  2 cef68d02-1541-19f6-bd37-305926552890
  3 b30191e3-6eb3-6360-a5a2-1a5d011c5b52
  4 9c3c5cd9-02be-8878-8115-80f2c3cfae7c
  5 19d1c80e-844f-33db-9eb3-d77d94d74fb3
  6 25431677-772b-8833-b809-19e9b2d7e0d0
  7 6c7e2cda-bbc3-6897-9d4c-ea97e4025e5e
  8 4769110f-7b57-5727-b4dc-753f1636a0c5
  9 262c58af-b64d-3872-9fb2-fe3a2f65de91
 10 aa643e3e-171d-1335-ba35-c70a6bf919bc

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8168386531. Exactly this sequence comes out of new Random(100).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 30 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related