201206271249 voxff

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 465

Metadata

Post ID: voxff
Title: 201206271249 → 2012-06-27 12:49 on A858's clock
Posted (UTC): 2012-06-27 16:47:18
Timezone: UTC−4 · title 12:49 against posted 16:47 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(465).Next(9) ✓ verified
Run: Run 8 (seed 593,707,075) (seed)
Draw: 4 · predicted N = 10 ✓
Machine boot: F 2012-05-15 18:59–19:19 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

D732C18B3F605CA3 ACACAD3FA78B38CB BE056597FB1834D4 F0C78C0A4FCFB992 835161BCE31088D0 EE9E8EA9A5357604 408161949D62AB64 3C267B2D30AD2B5D 9DABD16A592DFD94 C7AE2A295D6C3DDE 124DDA5F0654183B 470080689A136E24 31C354BDC71CBB9D 8067A4DBDE2B93ED 9E4DC344DBDA419D 456DFE946709F4A0 0807C5174AD96D18 C5CA8E53E5FE9BEB 6A852E514F37AC0D 37D030590CB6F81D EEFFBE2866520C4B 0FA5AAFDB15A2106 AB0D263A8C0BF1F6 6B4613422BEE673A EF0C1D22BC67AEE8 0281A0C0D048927E 0FD42A3F70A14E5C 5A1981F456C27485 179B808C4B16EC4B 19E4AD5EC09850EC 90C1518E6FC5DC5D EE13DCEAA0CD0B18 7CD69731F3FB9356 54E5828F7CAAEE59 8B3D439E7AB082B4 8563F37D603F8DC2 4F10E86028E5F8F2 6217A7BD5A189636 AD2D878A3D7A74D5 04C92432C9182E1D 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5c7949f3-fa52-54b6-9082-58d671f4b019
  2 b97fba49-1707-2051-b5e0-3fa23aea9212
  3 8cfceb83-72c6-7943-ba13-75bdf68c2257
  4 2d345596-669a-7fe1-8be3-6fd6b881d07e
  5 428200b7-4a6b-1f39-9252-5e33df1036d2
  6 18bb4629-703b-8be0-a33f-7eff31f9f113
  7 9b88c2e2-e13a-2c9e-bb30-01b9350dca64
  8 ce27574f-c270-65ea-8590-dd7adcf05ad1
  9 22c68db6-455c-426d-a0e8-f489ede26560
 10 1af0ee42-65a4-6f80-8c21-213674993796

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5277182646. Exactly this sequence comes out of new Random(465).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 4 of Run 8 (seed 593,707,075): new Random(593707075), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:59–19:19).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related