201206262228 vo722

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 574

Metadata

Post ID: vo722
Title: 201206262228 → 2012-06-26 22:28 on A858's clock
Posted (UTC): 2012-06-27 05:26:36
Timezone: UTC−7 · title 22:28 against posted 05:26 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(574).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 1 · predicted N = 12 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

520A6A8F4E86B923 538B6CC610AD90AF FBD5BA0B4A354244 0B92550E73171C78 E075AFF9EEB322E4 11AEF86D8BFF29BA 978F99431E1D103F EC874CCF5E292AD2 33AE56BEB6272821 A91C952CCF27D071 82BCCAC9928FC1CD 9DE602C4C77AC44F B19F1DDF9354F674 2A10A497CB4043F1 2A9347FCAF58E4D6 34BBD851ADD1C2D1 A2B75BD311BDA539 685A550F23D33B9F B1D0A4362ED80D6D 094D155E869A5BFE 8B16E0EF7ACE7534 D718BC5400BB95B4 86DF241577CE5A2D 5638B8CFC32DE0F6 9884F73C95C8A541 C0D9EA98F16612A6 C4C8F69DCF651450 047E68F55FF7BA52 82F0A2432BB9E70E 73AB270A8B7D9A6C 77CCE4107C129FFE 677AADA256762822 70F7971DE79866FD FAFE93EB49B18437 2745AD849CB1CBDA F5704EB5DA2EA797 87A830B0F1126B80 EDFD0CDDAD961528 8CBF18CC9FDD5298 92E51403D8239DD6 CF7FD813113A7AE0 5EFB97808B33CEB4 C6CDD3B869CFD9F7 458EA1166992AF35 7AF78A6D13F4B6D9 D0BFE052CC30C006 537D35FD9F46BC3B F33386576F957328 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cfb54ec9-8bb2-5d8f-a8d4-b00a332faada
  2 d44c09e0-9eb2-2945-8089-3777d7487f41
  3 9b49765c-09e7-8b68-a286-bbbd9fa695de
  4 6247ed73-2b22-0160-9c9d-395373322adf
  5 a3c87772-dd4c-39f4-bfe0-1420f44500f8
  6 b7111f90-05e9-1130-a586-eaa350a61a4a
  7 55b1ce9a-9b0e-0ee5-b6b0-114824274c05
  8 9b0a6d7c-3c13-383e-8c92-a669243b3ac3
  9 3f92806f-658d-8f52-8257-02776aae76a7
 10 a2f2f09b-c776-87c9-87eb-c2b739fc0397
 11 b890cb7a-79f7-153a-99c0-34ae2bd7bd73
 12 f457bd69-f1f7-5fd6-bed0-428cc81d072e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 528031038815. Exactly this sequence comes out of new Random(574).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 1 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related