201206272127 vojwl

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 711

Metadata

Post ID: vojwl
Title: 201206272127 → 2012-06-27 21:27 on A858's clock
Posted (UTC): 2012-06-27 12:25:29
Timezone: UTC+9 · title 21:27 against posted 12:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(711).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 19 · predicted N = 10 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

05516D825006B64B 8B4966550A9DE284 ABF5B417B2FF2BAE ECBAB66154C15E49 31791859C9984D3E 03C69CA48C12E4B3 6A82908754C2E17C 3CF4D963873C1D09 0AAB17B0A5F676C7 EF61B8E32B6B657F E90458E650E6EFD7 F4F3F6A5DC2C9E34 C7F44C0D37139E96 2B95D43825CDE223 EFB2EA205C185A27 738CF39040E158D4 73B9A61E664FE029 9C8CC61E16B4B0EA 2414FD56EF51A38F 00C17E393C579947 2E0F95DF2FEA1D5F 3BBDE7F2A2C37434 A5D3B6F1BC8A4E2D 1FA880119035D117 902C20CEF6333296 093CCA176F82EE3D F03AC6013846E8E6 346FD037252D0853 E26EE1FA3E402807 0CD4A80471FCE857 1E0B2A74035180F7 906525E0E37713DD FAFCE97E319D5D65 288D894C23F6D13B 7FFA26368A166FE0 EB974BCAF80C89BD FD268E8492C4B257 FD810EC06F025353 8E5B1E0B0096393A 4568BE36FD4168C9 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3d83233f-1e96-1577-b608-e10d5e1b7ed4
  2 4a9e1740-fcbf-3ff6-b1dc-59220c2060f4
  3 f927a839-97ac-618a-95a5-23fcd7f1699f
  4 488fa558-3e5f-208e-b446-4a9e8827c981
  5 ba370b90-4880-12c1-8273-8ec039245a72
  6 7585fd75-1d34-8664-9bd8-3f2d452e0a61
  7 d6cad10f-d539-4c15-912a-708ba29c4267
  8 f80749f1-71f6-1196-ac3a-1c55f7371819
  9 22280f3c-9e9f-8615-a0d9-2ee1f8dd3ec4
 10 d48a4f09-deab-42a5-9183-f2b0e5e83e6f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1362184184. Exactly this sequence comes out of new Random(711).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 19 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related