201206271851 vofke

explained decrypted filler

3DES(name) ECB, 13 GUIDs, seed 519

Metadata

Post ID: vofke
Title: 201206271851 → 2012-06-27 18:51 on A858's clock
Posted (UTC): 2012-06-27 09:50:14
Timezone: UTC+9 · title 18:51 against posted 09:50 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(519).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 9 · predicted N = 13 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

A2B167470F64EB6F 33E3E3DE4DF68F5A 0315FDA6DC70471D 99E395D1F30AB84D 1E6AE3753DAAA034 EF0DB604833CAF19 63C97E8BC8203BE1 F8CCA1BF5D9216F5 45C06E08DCC986B6 D6FBCE4C8E9142B2 E24152FB7E880D34 05576252ECA5711D 47D042AAD26C2192 3D27712F4280420C FEF516EA5B536D67 631B78A55519CFFA 440987D52FAA5D18 5F7CB45F4936F98C C24B1C73780DEA51 3EC8EEA41593E113 87D76B38AB8A49D1 C00F98FA41339ADD D702B09D7C5CB87D F7C63F8FD7FE2959 CDC35EFFED71D017 8DBF7B932F070BE4 8EDF117379492542 4325F0190C35E3C1 EE59A2886CB2A397 F87FCC9948A4E99B BFEC370E8AF6A377 C3C3EDF6FD8D03A8 08DDA56C9A84688F C6B27CCBDD5D5FF3 104FABBC4E9D7595 6A97CFAB4390B4B2 226C03E597A35895 3BB5BD46F6AE8A6F 394C22510C1FD553 B940851AD2947107 9544FAEEB1699172 4000B3EF6E714D38 229A73150857E8FD F2FF30E73333BA4F 9D84E2FB8A5B3E4C 7E03A8680007C9E7 69B125AD43BE576D 6B427307AFE9D720 154AA873ADCCBFFF AD2FD5245A547173 AA4497D23E4A5151 4AD9126C3AB75423 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c2062ac0-4968-7f42-be9f-316fe4e38fa9
  2 76fe466f-ba3f-00ef-af5f-519dd7cf7eb5
  3 3df9bd77-0b55-4824-809b-63ae57572e84
  4 699c0e27-4e39-35b8-b416-4a18c0d443ab
  5 f08f15da-990b-4efb-a640-292e7ab62c03
  6 d7d9e265-1366-1f79-a185-a13a4a2ba421
  7 4d91c744-433c-46b9-97da-c9a6f1e4daac
  8 3dd2eeeb-a43c-770d-b35d-b52df2cd68cc
  9 11ef0019-5cb4-1875-b074-cebc367f0eae
 10 cf6f8578-ea89-50f8-a55d-4a02c9dbe680
 11 b0f6a816-9cc9-5001-8c32-76bd44ce60c1
 12 34458db5-afea-579a-a32e-cddc11ab3ae4
 13 2513a365-d8b9-3ac4-9ab1-ccb738a6b961

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7043414715553. Exactly this sequence comes out of new Random(519).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 9 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related