201206272040 voiep

explained decrypted filler

3DES(name) ECB, 8 GUIDs, seed 930

Metadata

Post ID: voiep
Title: 201206272040 → 2012-06-27 20:40 on A858's clock
Posted (UTC): 2012-06-27 11:38:55
Timezone: UTC+9 · title 20:40 against posted 11:38 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(930).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 16 · predicted N = 8 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

DBC9ED748D2AC9A3 528D9BFC752A1C90 7287A002964966BE 5A8C8E9EC401A51B 05B9788B9CD28529 49D1953BEA18BA82 0450FA069927FEEC 1E0C069F9A16259F 6A985882FE750D11 30C4CC46A536DB97 09D745EF1441A55F F47BEAF03E85BBAA 91B570211AC03465 296847231FD52DB2 DF360373D6C39651 2ECC6BE6ACA7D8F4 C4E1EB6E22E8EE9D 54FFE31C4630FD82 6D01E5377B370D50 4AA61AB9E6FD25C5 443CA74D698811B0 F563768CDB4A923B 6547B65AAEA3A100 BE2DDE06FFF98AFD 5AEB0ABF31091620 092FC6C448402D5C C19465FA7ED70097 B6CC6AA03596B6CA 77D615DD879FCCDF C62C1DF67DE20D59 35831334F77D457C 90E4F3186219BD9D 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1860987d-14e6-5e02-af17-5a8a227557b0
  2 921ed20e-778e-6612-be01-902935156084
  3 4a77c3e0-0987-7599-9396-1675ac2e20f0
  4 08b9298d-52d2-08e6-9fed-0587c5d0b9f8
  5 8062e57f-a928-0949-a193-b3319292031b
  6 a2b0cd76-aaeb-2ce0-a2e1-1dc9436e0786
  7 5e5556c7-5f68-57fe-b994-880c5b9f56bd
  8 e872a953-fa4b-082a-9269-7f4b2d80ffef

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 56700250. Exactly this sequence comes out of new Random(930).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 16 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related