201206272315 voojj

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 577

Metadata

Post ID: voojj
Title: 201206272315 → 2012-06-27 23:15 on A858's clock
Posted (UTC): 2012-06-27 14:14:06
Timezone: UTC+9 · title 23:15 against posted 14:14 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(577).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 26 · predicted N = 10 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

D9ACB994CC6E08E2 5CB81F29B1E8597F 4391DCBC35CABD43 3EE24547687552E4 6A8101F5F1686F69 6DCB8AC1AD65D543 E5EF2A88BF5915E8 32A03C8FEF0DBFBE 7F00F8B5535C75F3 6BD10B884A5C36FA 48C899D48CE72F84 771791BE2A04CA81 82A49D8DC47C3AFC 5C57F0D0AC7E6248 0D4383F93FCBB4EA E4E281F2EB48F7A9 EF4AE3017CA05A14 4BC6CAED78AE489C D90DB0F08F959708 81B789A2FFD3F25E 16825C0C73209CD5 D1F5686612BE9656 6F454373DFA24A66 34DFDAD2259B8642 9178F7EA10A2486E B03B526E4109572A 8D449E61EEE6D703 05BBE261B5614AE0 879BABC93399D452 B98533FE2422FC1F 4E27552D9D9781C8 98819EE29086DC80 B4413CA36761C99B 68BC056F9461D99D A0451E67F6B88F34 988E372D9CBEA49D F765C6ECEEE9525A 83D026DC7BC0DDE4 0BA89DE1C71E08CC 11509AF4F34322FD 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 10f2246d-c4c5-1822-871d-0ed1fa71d540
  2 3d429cbe-5281-1429-a033-0c56e48fca74
  3 bf3a93c1-2503-080c-8a27-4f4ef41f62d6
  4 b1e87d9d-fdee-6d7c-b55b-81044f5243c9
  5 fd55e390-6429-6fac-a7ac-26e8b0015694
  6 cdfc3cca-968d-733c-ba2f-f2f00c85534f
  7 8db323f4-4061-3741-aab2-9d658f026b34
  8 f7547900-18c8-8282-ad70-e218e5b34392
  9 43676197-30fb-36a7-a3c4-e3033260bf5d
 10 e42b6c5d-7c3d-0cb2-b0ef-402b6a8dee91

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1106673830. Exactly this sequence comes out of new Random(577).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 26 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related