201206271938 vogpi

explained decrypted filler

3DES(name) ECB, 9 GUIDs, seed 976

Metadata

Post ID: vogpi
Title: 201206271938 → 2012-06-27 19:38 on A858's clock
Posted (UTC): 2012-06-27 10:36:47
Timezone: UTC+9 · title 19:38 against posted 10:36 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(976).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 12 · predicted N = 9 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

8DC3CA711B524211 50F9910805F0969D 87B6D86417B7100C 38C8FFE590A7669E A6D53979154DFB03 88D40C8CB8CCAABE BB851FE017FD5E58 E0E06EA0D1339794 915C29FC081B6045 6231D759967CB72C CF430DE5E9AD784B 5FC7434813D45E2D EE7BFA729D231CC5 CDDC581763493262 314205A9E5E966AE 5697E702CB3543B6 9A04B82F15DA3DC8 18F40A0E15A935CB FFA9D08B11D4F565 F838D289F9267948 D083229C1695BBAF A168BF3B4BC3A787 419210BDA7885C75 65B7C0081379A0F4 1B021D0AE7133A01 69868CB71966B8EB 65F023CAB5710D61 15387C373D05A2AA 6B099CAFF20A27F4 7E3F62B5C1E757A6 241D2B8F0036CD88 F045E7D88AA075D7 F6A77C309BFC3BED 8A778B31F514CDB3 A634B92737EAC782 91A27E4FBE0DC719 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b951664d-0883-5f16-90fe-12f415c8f195
  2 0841b514-3c3f-1843-8b18-444e499750ba
  3 5b435aa6-5abf-84a0-92c4-5e97a2b66457
  4 46688a04-860c-729f-a47b-34f9928085eb
  5 528d5d96-1973-7603-967b-829240530776
  6 d9c6c683-6317-4fa7-8a7a-5abe13b0b469
  7 d2213e26-ffde-1bed-81df-b3d490a1f1d0
  8 6dc1615b-000b-02c8-bfed-160239d786a8
  9 5f397e00-eeae-654a-a1d5-952806acf55a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 518774106. Exactly this sequence comes out of new Random(976).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 12 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related