201206271836 vof6z

explained decrypted filler

3DES(name) ECB, 8 GUIDs, seed 124

Metadata

Post ID: vof6z
Title: 201206271836 → 2012-06-27 18:36 on A858's clock
Posted (UTC): 2012-06-27 09:34:42
Timezone: UTC+9 · title 18:36 against posted 09:34 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(124).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 8 · predicted N = 8 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

C330861FDEB45DDC F0B68789F4E38237 2B68987BD8B81A4D E121CE77CC31FC73 BA127E24CB7B11F8 706585FD9B4D231D FBDB1DB15CE7DCC5 838FA4EE5430B060 5280C72B2DA7A1C2 73884F99824D1B0A 4AA1C682D3D53957 8369AAE69A5EAE95 A1D35FD470FF4E29 8A3001CB06CB762D 5C9CEBD213B0A864 72BB13E6DC57C8F8 E46C1339F7827A5B A78F879AD8054AF7 44560BA430F3C40F 53AD09B22443C53D 4B94DEB4CE956C83 880768E624F82044 5933F20C6CEE5DF8 9C21A562B81A502B 1893580502042980 70554047425E5FBF 3206FC4111E65427 D2CFF53CD42AEBD8 BC9F084550885CEB D7868D8A185DD6B8 A1833B41CA4D9F67 4A81AE7355F852C1 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4e7aee7e-0be3-49d2-9c70-1f74dc8322f8
  2 1e9a6f0d-9aa3-1f9e-95df-0647dec73290
  3 c4603f11-1706-3cbe-a1aa-b402ba0cc128
  4 f854cc63-7548-04d2-87f1-c3ab54a025c0
  5 2ab947dd-a5e7-1e7d-a61c-5c7f35a1782a
  6 1c09748d-cdf6-8799-b7bc-3a174cbfad60
  7 a22d88ef-b1d9-4855-8bf0-1efa0dd8a4c6
  8 70869aa2-4397-5b85-8608-f9f2b4844d8c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 41301845. Exactly this sequence comes out of new Random(124).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 8 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related