201206271734 vodoo

explained decrypted filler

3DES(name) ECB, 15 GUIDs, seed 407

Metadata

Post ID: vodoo
Title: 201206271734 → 2012-06-27 17:34 on A858's clock
Posted (UTC): 2012-06-27 08:32:34
Timezone: UTC+9 · title 17:34 against posted 08:32 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(407).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 4 · predicted N = 15 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

0B7C605C523C18C5 6F5D5D720712D795 F2A3BDFE5062B9DA FD8FC628640EDFE8 B910ABF21865EABA 63710540538D21B1 95143D81FC087323 811D08FDC9CD3ECB D90884CE852846B5 6EC7660C613DBC3E 3DAEB25024C32639 518077DED162FE99 54F56859561603CF 76255DEDA754AD3B 38D205D7C65EBD51 5ABB28FD98BB91C6 48EDA2602E2F09E2 1E5BA660EC220BB4 A02A5152EECECF22 69FFB2185D96DE5E 551F1183C19F59EE 6FEF1F7FAB50BEEB 88BAC4592906CA93 7A744A4302F4BE46 1EFF3906CAA5B3C0 1D6EDD4DB4F2C168 9441AD8BFF32E426 920AB1962E18DF8F 361B6F8CFC819243 3E1DF830D5191564 24A31030A1836491 C845BC930BC367FD CE4C2D3833B41DFC EF449EE582BF004E AD16F859404F040E 0E3278E8766E209A CF578A1A105066DD CC3678B99F51D578 5BD60FA67E058BB5 0842A80BC8CB6500 39401D3D9CBC7BEE FF1AD63D58201FC0 AF639AC93790FD85 644F5E1A603BE5ED 3223E139F17DFB05 1F075D38F1CD58DC ADD5B3D7B1CE149B B2DCFDD3BC341B94 9213877FA836CC74 50922881F5203A14 17E7FE0E706CC283 63DA34E09B7CFF54 30EE4C1E96ECCDC8 2C043033D187F641 FF3466DCD6C0497A 306E6E85B14F350E 3F8EEFE5AFFA96C7 D73FA53C3D377664 244DDE6F0844AEB7 55416B3A01F6C7D9 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 bb597b2f-6997-3ff9-bcd8-bf6e6bbc1e3e
  2 7c1e55cc-4890-25da-a95d-91d7cf193ce3
  3 74456d68-df5d-2f6d-8adf-8d728816f9ea
  4 6eaf61f3-331b-3efe-8a24-36e662982b57
  5 0ed3658b-0432-802a-8cf5-aa48b8aab4bd
  6 8fe1bea4-d4dc-2c95-a90a-3d01a17fecd2
  7 b0d11a53-9f61-20b4-993d-a1f835b9fd83
  8 cf13e71c-0fbd-5c0f-838a-6ee90456b981
  9 1b9f4bd0-c404-2837-a73f-fa023b8e322c
 10 14d88634-df56-3bd9-9ee5-54f2fefed312
 11 b7f17fb3-dbdf-190f-b3a0-6418f5a47a1a
 12 48f0a605-7919-19be-8fb5-e617698faa85
 13 f411c76f-dea5-3da0-ba82-43ea2d8e7eff
 14 80483fd4-46c0-1d08-90eb-384ec9bb8cf8
 15 f94ebc3a-f83f-7b82-a3c6-1d9146610f76

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 322382252311317. Exactly this sequence comes out of new Random(407).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 4 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related