201206271309 voymm

explained decrypted filler

3DES(name) ECB, 11 GUIDs, seed 933

Metadata

Post ID: voymm
Title: 201206271309 → 2012-06-27 13:09 on A858's clock
Posted (UTC): 2012-06-27 17:07:19
Timezone: UTC−4 · title 13:09 against posted 17:07 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(933).Next(9) ✓ verified
Run: Run 8 (seed 593,707,075) (seed)
Draw: 5 · predicted N = 11 ✓
Machine boot: F 2012-05-15 18:59–19:19 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

BAC16A0594A80B37 A8BB10137CFA0B82 7A3BA8D0D66F2AAE 4DC967E142BA07EE 4459C0CA2C859519 112420FBF1EEE83B 8F8291F5D1B067C4 18CF8682ED49EB2F AB0D97D844BAD8DF D9A86499F0AFC79C 031E1D6FA49AC817 51C6BB0AB36CC0DF 8BF51E8078597C99 025AB4E1754B5479 D8B2673722B49711 93908FE2F953119B F344E9E08312DBE7 4B5759B84A0CEDF7 2A4D6C89C442A9F0 F1482F7C33F9B0DD 2A765585196E7944 37AC5728AFABA8D3 FC979B7D52B7E9AC 95BCF3C1E89745D5 FBCC4087D260D51D 6E668181AA7DB963 4018A39F5027E477 6E8BAEDFAB4C3603 A8247656687501FC 23BDA26D946BC29A 32BE1D1C19DAA10F 6EC1CEFA4A6B6700 BD9E041B9E38591E 72062A17349D59E2 35D838FC6D783426 1E6EDBF0F60D5245 30AA65B826DB521B C502609FDE9D75B4 A2CFD14B9C459A78 7BBDB2520373CF4A C1A52F16145596D7 9708525B105D0581 BC3088A51B5DB4EA 849888C8581550EF 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5d969771-400a-1546-adb3-5dd9b2d7effa
  2 bfe9aae8-0faf-5568-9131-5998c6a384f8
  3 cf6a74d8-f0da-8e3d-94ba-7ee2147edad2
  4 47d82d1f-d371-62ff-865b-3a7656f7d050
  5 fbe44cdb-b1c8-3216-ab6e-ed0830829619
  6 ef0d6e63-44cc-8687-8633-85571a882670
  7 60ef85de-6a68-896c-b9aa-5aafb9b3f59a
  8 6b3958dc-cce7-496b-86e4-c2da51703671
  9 11cf7e3b-8288-36e6-8bea-12036360cad3
 10 d4507db9-8df2-208c-b4b5-3bd5c7949599
 11 f2113ab7-5446-52a1-ad19-06be96148291

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 15863884325. Exactly this sequence comes out of new Random(933).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 5 of Run 8 (seed 593,707,075): new Random(593707075), Next(8,24) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:59–19:19).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related