201206271907 vofz2

explained decrypted filler

3DES(name) ECB, 13 GUIDs, seed 914

Metadata

Post ID: vofz2
Title: 201206271907 → 2012-06-27 19:07 on A858's clock
Posted (UTC): 2012-06-27 10:05:45
Timezone: UTC+9 · title 19:07 against posted 10:05 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(914).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 10 · predicted N = 13 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

412C70986BC1076C 1C9FFAFB7FDDC881 787541251EBE7B28 8E6DB2D31413F61D 4E2ED5124C36211B 60EC79ED72429656 1A5178A65F09156F 0B4A1303CE9068AB 21915289950EC312 52539B0F66615F3A FA84B468154A6BC4 55906B26643ADDEB D681CEBE4305245E A2AD06803667E9C1 8CD6990AF4CBD5CC 4468D26F2E74C86C DD49C74C847A41BB E4B78886FC7D8F99 FB8EDCF1B16893A9 608ED14C25B8B11C 3ACF3E186E419FE7 2D03D6B7E7E80591 AD516305346B91B3 D456FFFB09007DCC 414615061DF0E486 92DF092B5E727C90 91946575F97734D6 66AAFCA16A1DA014 7C83404A16AFE75E DD7C17826FCD3008 3B2FD35A165E0D82 74359B4A7ABE887E 9F6476A3E0C2E695 4313829461847C3F B0547DC00A93A9A9 26EF54B95E8EF503 792FC878F25489AD F64BE160E2631DCB 46E387FAAC7A1AAB 62534DE54DF34DA7 FF95A17D70314599 25364D26612CC985 4628E5C357392BE0 70068F7AD99E331D 4E60F3CDD69D4206 8498835CB64D1BA1 31A62C51D02F9436 E40EF35AF0292A0F 7D8461DF26091990 40B1BDF0B9B2BE6F 1A570F72A428AFD3 107BFC38BBFF0F8C 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0d23ed0f-f759-20cf-a7ce-fe64fa2e05f0
  2 80d84651-cabd-0627-b059-87f2ad3c1ab6
  3 715b0265-869c-5224-91ca-938fb23f716a
  4 41c73861-dd69-5846-8dfd-8131e2a5b226
  5 a339280f-1a25-78e0-864e-47ac9af6e754
  6 73e390e1-a501-25e0-b1f8-cc1632a8bf5c
  7 6805ec81-bc59-32b7-bd8b-9bde193f1cb7
  8 c653835f-fd1e-81f4-a585-cc7483b3d37e
  9 c35bab58-1e74-0299-ac57-7b5c1dd7a176
 10 b07a6d7c-a328-252e-a5ed-f2798fa12110
 11 72766e00-4270-531e-99bd-bb9b1cb961f0
 12 14b4421e-93a0-0026-8cf8-4f5f281985a6
 13 9603a22d-ea41-8577-81c4-fa3cdffe42ab

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2055723802508. Exactly this sequence comes out of new Random(914).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related