201206271409 vp2ki

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 377

Metadata

Post ID: vp2ki
Title: 201206271409 → 2012-06-27 14:09 on A858's clock
Posted (UTC): 2012-06-27 18:07:27
Timezone: UTC−4 · title 14:09 against posted 18:07 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(377).Next(9) ✓ verified
Run: Run 8 (seed 593,707,075) (seed)
Draw: 8 · predicted N = 12 ✓
Machine boot: F 2012-05-15 18:59–19:19 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

E6479A7EF31ADDC7 520BB2483820E4E9 F09028D7F9820DC7 5C891678A514B1AC 4A0DD3ACFF850470 884E5FC9593DD273 0553E3AAA835F3E5 AD21CFFFA50A0DB9 803B6E2BB89A85DC C6834D9734E1D951 D64B261ACC32438B 04B91061038D6DFC E499B59742BBA2C9 585FA16FAC1BFD2E 3D9E9B08DC17C9D6 853AB24CDD9FC0F9 A1368D6CA25B5920 F4C9DC5851E19ADC 922A4BBCC0C9437C 163B45626EEE74DF 35ACA4FEF8BFA609 05D5064FA8AF672C CEB778B0519FDD4C 0140BBC3D11EA338 68857A68E0C3EEBD AFD0F81925C4A0CF D11AF6E08879ADCB DC6A70D35AB95E00 5184E79849A8792D D77270FF923DE1D3 40535A482FEE5EA6 B4E5A5F2581D9183 E6C7F44EE154597E 6E424768F361BA8E 1D228D45060D11C5 62B7D46DD0C18F20 F528CF1B46A9BF72 4F9956BDCD221A06 5250582CBC1B349C BF7C90E9BF4D4E69 8B0C5AC86EBB4995 503B0D871B7EF522 3390F35BD90DB5F3 7A2B66A828566141 48217FC9BC63CB82 8F6226D5C677695A 87B165A2EE345E1C 66366A7F9A9BE5DD 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0e9f8703-97ff-6af7-b231-f7a34e08bbbb
  2 c8a2b9e5-adc9-3aed-8639-31af4c8c4bb1
  3 5b3de40c-2895-21ab-bc6c-6bdadb207527
  4 01d65b77-6362-0bee-9f42-b8977263aab6
  5 3e090293-d67d-3e3f-9cc1-a2d39ef09de9
  6 bc742556-fa55-0c91-b95d-33695a744a6d
  7 a483650c-4892-76e0-a00c-f0f9f078572c
  8 121ec07e-ec6d-546c-8909-a12bd4995beb
  9 c785d127-9511-59d7-b44a-07f70430fa57
 10 414059b3-d509-2872-b112-7f24beae71df
 11 b4450e21-e6ee-09e9-b759-4c0d00efe05e
 12 03a6c41c-7377-729d-acc1-bde2fb7f7ea6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 632030755207. Exactly this sequence comes out of new Random(377).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 8 of Run 8 (seed 593,707,075): new Random(593707075), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:59–19:19).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related