201206272331 vopbr

explained decrypted filler

seed 897

Metadata

Post ID: vopbr
Title: 201206272331 → 2012-06-27 23:31 on A858's clock
Posted (UTC): 2012-06-27 14:29:37
Timezone: UTC+9 · title 23:31 against posted 14:29 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 21
Filler GUID seed: new Random(897).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 27 · predicted N = 21 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

CC4C03317638B8BE 7646EB29D22550C6 13EA4FE324FD5DF7 B05409541A987646 FC372CCA0A5DF233 0DC569A38D326D43 7AAA9F3B57FA23F3 15017437424B4797 0452394E12A756AD 30925E8C617FE67E 972CBBBD635A08DB 8F36D520B8141D5B 8529684A0CCC4218 C6AAC5E13293EA50 B25D84EDC2BDB741 50A6A4C7331702C5 94D504E18D32F256 79A6E67851F30720 60BB719B762BF204 32421E493A0781A1 6395C976C6B4451C 8177FE2EB5532BB4 CFD7BC83F41F82D7 D89E474D68D27848 5F959DCE4C37FB95 388BFF87AFACD63C AB362FA45018A18A 07B0763A319B3807 EFA9892B964E3B2A 6DF54D9FE8E0DF50 3C761FA62BD6F40C 188E4F3726A7C882 B34AE96CD6F98A14 812B2FD7E207D88B 3C22B23798FC9ACF CEF55BC5F031AC3C 6EB95333CEA19BF3 9F9FA0D478A6328E 0784C549A1164181 4A8B7958E2BD8497 953FF73B9072D446 9E4355B985B422C3 80AA71B8F0AEFDD9 DD8337BD1DD9CBE1 84469127487B1A4C 8190DE1D75941E27 0FCEE1CE21B6E5F1 43EAC08C65C7DF98 AB6548B805DA8A06 21F65A8FDFCB1EAE FD6F136ADAA094DD 89BB24281F325552 1E3AB0B23EB20831 CC29CE0FA7604118 914EA5A8B5815390 165529A95A7B9C44 1B0D8A3FCABD22B8 42889763BA8AC0F7 7D3BA3D182C40AE3 D34B32DD9BC17725 90E10D289E14CDC8 E445770248F7F0AF E312BE630AC7031A 08B43D2FBC468C15 8D30D3BE63D4370D 07CB8F67CBF865C7 3B023AAAF31885F6 75E4A94C6F3DFDA6 9A932554FC03FFE8 8503A6A194D87426 60C0D66548A0E553 D99EC3D55D84BD0E 73BE42ED3954DFA2 FB71FFC3801859C7 68F3983D037CA590 65C4507DD76E79AA 4EBA593DCF39BB49 6439D9A1911127D5 8B77CD9C771C0DBB 49E14792AE0DD10B 52F838D726E95D1B 7B4EB08663333EB9 B5F05D282EA1DF18 5D50586FB1C67890 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1f5ad91c-69c2-3ada-ab77-98cf9d6fbd66
  2 d84886a4-e36b-09b0-960b-345d1830f393
  3 d9fda0b7-0420-648b-8098-c4ca383b3b64
  4 6ce62f9c-9cfa-059d-8a51-bf2c24c7850c
  5 2a9deb16-b7b0-1009-b009-ca69998c3e2d
  6 a5fdcdaa-ace1-419e-ba98-656d33a80a15
  7 f9309d75-0d9b-7df1-8f40-f3b05b6bcdeb
  8 11f4569e-b65b-4066-a4a5-0d64d9e8833e
  9 edaad1b4-ccdd-8271-993d-ab09894d0301
 10 a617f5a5-1b14-0319-8a76-6d1e53e016e4
 11 af484046-e1eb-125b-92eb-ec6d6b93c3e2
 12 76e479a1-0abc-6fbb-a3da-737a8c67288e
 13 d4dbea87-0386-23bc-8d50-fe4401502cf6
 14 d2496d41-211b-1ea0-93c8-4c7dbf897ca9
 15 8e53ca95-7590-70c8-9ca7-35bd350e1de9
 16 0393ac8f-0163-26b8-b274-6dc3c1fb97ad
 17 d28904c1-4396-868b-90e4-3c9f7fe77eae
 18 126cee22-b92d-1b94-80a6-1eae722b1801
 19 39c8ee4b-c85a-820e-8c53-49ef7037c4df
 20 037b0ba2-5f98-5479-915f-9347fb8c54e3
 21 578e9f18-e4c1-0fc8-87a3-d3c8afd73621

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 306014748016217281850. Exactly this sequence comes out of new Random(897).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 27 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related