201206271146 vo1ms

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 985

Metadata

Post ID: vo1ms
Title: 201206271146 → 2012-06-27 11:46 on A858's clock
Posted (UTC): 2012-06-27 03:44:14
Timezone: UTC+8 · title 11:46 against posted 03:44 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(985).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 32 · predicted N = 12 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

2CC51BBC986A7B21 F4E947DD9076C6C5 DCE8DB58FC2E11C1 A787295EFA9E59CC 8C469670DAF0433E A3C4790C7BC2EADE 5B86CE8196861B33 6A79A61E406EB168 9599736365C0F344 5A32344A9FD548AA AB7AF18E64A1DA81 80E6FFCC222CFC1B FC6F936627033AF6 CC63F620B435113B 0B066ABD7BF380C5 A2B8E47542B89CCB 1A3E0B1CE815B500 0F55E31B4B723540 5C52FCF8A5D54CC9 DC079176B02A4F9B 4B2FA662A6AABBE2 64AFF7C276279424 C81BEB9A3AAB22FC 6067DAE1C0A6CD67 12870E1A9C03112E 991BF61AFC072C1F F16A2ACD190A8494 8C3B81FDD88BA0FC 1E879568B39FC520 CF64B270E24CC666 2902E8313BF2A732 E215795209F9FB8C 74031323E662E49F 7650A758FFF5DB73 095BD8D2169EAC50 9D380A3724174A21 59560F96D6C338E7 71A93597F8B9396F 3ECEC4C07346F2AF C4EA230BBE41B034 398D20C046A8D20B EECBAB3074280CC4 8088D693532D8F70 BCF1E2280E15AC94 084E7317CB61765D BAE774CA6AC10A88 15879FC5D4CE01D2 D2A04C1DE932CA51 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b1c94539-d21e-229a-bf9c-dcee9bdafdd4
  2 4ff5cdd3-2369-7ae1-97bf-b4b00d72c258
  3 940816ca-70e6-26dd-9292-b6e7810b2225
  4 c46a9cd9-9b94-70ab-95aa-ecc8ae4e4e7a
  5 80ad461a-f030-81cd-be51-fb87e1042fcc
  6 5ffe3e48-665d-305b-a9d2-2d0644457ebe
  7 a51b6e6b-3574-202b-bd3e-d2ad9c9f10be
  8 b42f0a03-eeb3-5a82-ac42-e2c34a5b622e
  9 c7bb0423-d874-7dc9-9198-306cda9215c7
 10 dd1a4181-086e-4e65-8edd-5be4b4ca70dd
 11 854cfaf4-ab0f-868b-b5ae-1eff0c47faae
 12 2ef7f944-f907-4eeb-9513-10cbdbd2a9cb

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 272783257484. Exactly this sequence comes out of new Random(985).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 32 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related