201206271156 vo26k

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 62

Metadata

Post ID: vo26k
Title: 201206271156 → 2012-06-27 11:56 on A858's clock
Posted (UTC): 2012-06-27 03:54:15
Timezone: UTC+8 · title 11:56 against posted 03:54 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(62).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 33 · predicted N = 12 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

7DB6EB7CC39AF0FC 959D477D5DDAC681 6E03A0B13EF85506 FCF35D4393E0AFB2 D85C7A78D9D6DC69 C75F4F94C753D100 BC1DA687441C8616 DA7EC88C6C1D6A1B C1E380A41BCA3A9B BA6F19A31DFA78D3 CFCBEA3F2DBFC191 6457874E688A6118 0D18513E3FB8C6FE C55D89247357C415 18EF11D26CB09447 38D60517A8F75BD8 49755145E8CC567A CBAE62BA7713E31D 4490FC8D36267F58 C023851898FB1256 CAC4358923FA659B B191CAC29B9AC7EC EACCD3445A7DA0F7 0A6FC74454078C03 D409D8B1CF8B9496 31FF67828EF8072F C185C707353CAF99 3FC433D67316192E 4358FE98C735ED6C 98A66306EE53E79A 3322F5EA38FF133F A2BAA932A70A2889 614CA2943ECCE61E 73950ADB14B25B53 E5993D6039E0DFD7 0EBDE6859FAD7A6A 60C5BFBFF394B202 ADC6A6F6AD7A2363 49860897EB68DD73 B8F74C658B24F668 49649F59847941D2 19DA59DEF52AAD9F 420071B949F99DAB 8224C30FE01F872C 2B0848B3816B5A32 1FE228F4405DD54B C8D748948323F72C A7D9DF8D1D0BBD8E 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4bf2643d-fa61-1afc-89ac-b4621d4f6dba
  2 af8fb199-ee05-0407-ac24-32bb232c966c
  3 f861d5d9-e088-0658-a895-32332095ba4f
  4 3c1f2d95-feb6-711b-8fe4-d2b33a382edf
  5 1bf12d6b-ff2d-1117-b589-ec3781da1e30
  6 9442f6d7-6a5d-620d-8db7-ba3162e4d630
  7 d1234712-c121-6c7a-83df-d0b22697c506
  8 d4d2c9c2-8417-403f-875d-aaee07a26e76
  9 d0f711de-c2d2-5604-a928-4ac2b806bb19
 10 444c268b-114a-14e4-87a9-cf6de7de4a44
 11 a2d90bfc-4246-8e02-b38d-f75763134521
 12 723c93d8-da4e-7014-9259-f5a7df315afe

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 100716645187. Exactly this sequence comes out of new Random(62).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 33 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related