201206271718 voda6

explained decrypted filler

3DES(name) ECB, 16 GUIDs, seed 923

Metadata

Post ID: voda6
Title: 201206271718 → 2012-06-27 17:18 on A858's clock
Posted (UTC): 2012-06-27 08:17:02
Timezone: UTC+9 · title 17:18 against posted 08:17 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 16
Filler GUID seed: new Random(923).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 3 · predicted N = 16 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

1E3AD82B2EEAE7AD 532E7D10F072AAD9 FDC1E384599C599D 66279108D862D73B D27F86556657B714 6AC24CA4F056D8F0 541F62C1FF220F05 DF6FFDB9C276AD53 81A5923FB444A0FE 59FB065EF49DF509 457364B1B4DD7C46 EFDE6D69D67CEB2F 621F35DE5E00145B 6687372A233C7357 B86C7D39635605FF 9885A37399AA7B4E B9C07E82D04DB71F EEB84D6EF1E7AE71 ADC0B2FF35D8F459 331D902651B86226 0EBFBCB366A5853D EBB47D7B8E197C5B E10623700EF4E104 3626378B6B29E523 7402524E7A6F7294 531F989849AA19E3 233BE20D8C919A84 73BF2C65C982BE52 312E2DF7C5A93151 12FEEC021FB39A73 80002266F3DD7D78 3B79B486B50A785F C9BCE1F5E896587C B1E59D8CDA522A71 6D029455DB3070CB 171857E194C238AE 3066C39503A4CEEC F9713D9804399983 A54ADCE6B8F33581 0F4B1FC1DFC499D5 B3CCED3F552F56E6 FAC3D4D6AD0CB01D B5E3317202606D29 18CAC9D251D9822A 75B6F47B12399C39 F3097CAFB078C05B 15C9E74FDD667465 C34EC6824ECFED1A 20F517AC2239CCF2 D7453FECB308B8D2 1E709B9644011B63 5ED8A2C742B9999A 09D84F3E7AE45CA0 1EBC6892F458C63A 07947BB7B123F0DE 30DCFC2662DD6701 6D8DA1C2A75FC1FC 3596FFEA6A010ECF 790203B3D29ECE25 11EC03D7119A1282 CB7161CBF7DBF34A 9947795AAAE9515D BDB1324121E5D769 FD67DE3B20994DD4 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d616ac63-82fb-8e4a-ab5b-e77c56f270d8
  2 ae0b7779-13ba-5942-b889-6b18cc93d802
  3 c9a7f355-9a14-8696-b22b-a8825289702c
  4 3cb06be1-414c-55c5-b659-1fed4b3135b8
  5 952a27ef-b3a9-88be-b0e1-6b2f3cea5a25
  6 2df1e808-7d09-1f2b-8646-2d04c4bc5c86
  7 eff67342-975e-491b-8a01-295d7bb4c64a
  8 2b9006b4-8be7-4c29-97e3-4da4a9175636
  9 73a1a15f-37d9-10a0-bfa0-2b94ad84524e
 10 79cc77d1-7bc4-52b7-a4d0-ffc091a55934
 11 4bf5d665-42d5-290b-a07d-91e748f8b90b
 12 459dfa42-af68-0dcc-ae0e-aebd61d0465c
 13 e652fc1c-3e8b-105f-9bf6-bec32bd7c607
 14 24884c9d-d575-5494-970e-b8f632f89c48
 15 412999bf-803a-0c53-8c62-74bbc2c8286b
 16 26ce9583-1863-470f-920b-d66706ec18fc

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8585814415201504. Exactly this sequence comes out of new Random(923).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 3 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related