201206262228 vo71s

explained decrypted filler

3DES(name) ECB, 9 GUIDs, seed 767

Metadata

Post ID: vo71s
Title: 201206262228 → 2012-06-26 22:28 on A858's clock
Posted (UTC): 2012-06-27 05:26:31
Timezone: UTC−7 · title 22:28 against posted 05:26 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(767).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 0 · predicted N = 9 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

055E1606D4EE474E F5EC9799517D3A6C 669820F8D8F964DD 11C13E5D7BAFA3E3 B8B4536BD8A93948 BAE1EC22807C9995 EB43A2B8B3A47F9E 0FA02F4A9DB81F04 A7CFA72C82FA190A 8E48E2E8531EB7A0 74A20E13D4D9A458 3866B65C7F8C418C 82BF19603A083758 93290905A4C80A52 B26F036FD7FC85B4 B6DCFE5BB3AAAB44 FFF1019EFA642551 EDBB864283E8D479 4506D3D7BB6811B2 B8B72E1770253893 913F036837EB468D 6575F6B395A61474 B33D995B78ABCE6F 6A2E6749E03E33EC E36F7835B3680B22 733D5CEB1FC43AC1 500DC049309B6B23 D37E94A8630CED86 97B0BB15855E5545 0957ECB8BAAE63D0 201540EF5BD6D986 652D46D94C24982B FA43271BED2AA3E0 759E1D32D3FCC9E1 C9C7AF9F5544C902 3BB84346ECFC007F 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0be1835a-ab15-3076-976f-143e3348a3d9
  2 659f5724-b18e-7873-a2fb-2e18d313cc1c
  3 b9a862ad-1eba-87b4-8852-15d3e337b375
  4 96de7278-5fe3-2303-bf85-a83bb24d2ff0
  5 54ce60e6-b99f-4484-ad38-64f84f719de3
  6 55f523fd-3807-7007-b1ea-be3797d461bf
  7 c5316c49-9674-562d-936a-5b9dd0f6e73d
  8 a7623f09-2f8a-2254-ae15-82b1ed893c83
  9 d215bd1a-3f33-76ec-b1d6-940bfec3f96d

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 378247527. Exactly this sequence comes out of new Random(767).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 0 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related