201206272025 vohxt

explained decrypted filler

3DES(name) ECB, 8 GUIDs, seed 504

Metadata

Post ID: vohxt
Title: 201206272025 → 2012-06-27 20:25 on A858's clock
Posted (UTC): 2012-06-27 11:23:24
Timezone: UTC+9 · title 20:25 against posted 11:23 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(504).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 15 · predicted N = 8 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

B665C9B0287352FB 5718799478BAE908 64E51C6799A60A0D 75F4CE71D65F4BB5 121F476D1D7DA508 6014BCD48A585577 6B659E1A0AA44B53 72442EAA2DD68FAA EED15C40C2FEE6EE 39FC374EBBD863DE 850D4CCA4163BCD7 62921D6AB32BD5A5 3A1479BA58715F50 69EDF6E643A4D672 6D75DEF5B70D113B E1742E5DCF30A0A2 B2FA14CAAC24F1EE 209CDB3D1287EE69 EBA8F9960B74680E 7A86D7A01A0CB047 82569DDA40ED2BD1 DD3878C45C574A48 3C92E2636EA78CC4 3227AA97E0865800 38CBE8F62A2DD2E9 A0929033F88943B2 BA8912ED3C9962B7 FF219FC8E1BFDBA4 6A7F01C588F53D1A 0AD1A92BFF14E79C 23DF9B8CAC20B730 8D7D1CBAF0633773 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1e51350c-beae-08b7-a232-82763d859fe7
  2 d0c7ae9f-fd03-6100-8797-2f3e4b7c39d0
  3 fcdb7989-cfd1-0b1e-96da-75bf33096cc5
  4 dd50a683-8d25-1243-8c16-150030728e8a
  5 2c539f96-c84b-6054-b97e-10f8a7657d53
  6 749576bf-f76d-03ce-9408-ed83d3a82f9a
  7 8dd94024-300c-6c86-aebc-8552a9f921c8
  8 6614047f-5421-27f0-b009-1bfa878ac898

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 06016062. Exactly this sequence comes out of new Random(504).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 15 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related