201206271449 vp5a6

explained decrypted filler

3DES(name) ECB, 9 GUIDs, seed 89

Metadata

Post ID: vp5a6
Title: 201206271449 → 2012-06-27 14:49 on A858's clock
Posted (UTC): 2012-06-27 18:47:30
Timezone: UTC−4 · title 14:49 against posted 18:47 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(89).Next(9) ✓ verified
Run: Run 8 (seed 593,707,075) (seed)
Draw: 10 · predicted N = 9 ✓
Machine boot: F 2012-05-15 18:59–19:19 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

AE77FA8A3B106A0C 608C4E34D222A2AD 394EAD976F73B57E ABA6617D565EB3EA 8C3DA0D8BA405A1A B407730AAB5CFF00 820A5D00FDC852B8 DECE1A6C5ABC5AEE A3DE734C010E8381 AD39058EFF0C640F 81083DFC01AB78C7 7C2E506B3748AACA F0D773B1684DA1EF 64FA3B0BD1FA3FA1 B317008E455C5A04 AEE5B00BFA1CFBD4 B26AA10C1B30CB99 1F532A0D2C616484 B129B31DE243E98C 397DE440A8A2D837 B66EA4A5E93210B6 12152B52583DA989 B8725C10969A163A 67821699BA2107D1 0777AA58B5D9A0BF 8CFC43264B924F87 69AE897D06E2053E AFAFFB1910C91307 73748F5AE34999B9 A99523C05D49AE5D 9158E0DCD8B61ED8 DCF4DD62F06E2BD0 8122FB47D07CFF58 BBE326067B1AF847 60D1193A7B4F7D22 332C57E483CD1FEB 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c754ec78-be6e-1468-8749-251665db3ba6
  2 a659a240-ce41-8272-a062-e5d108bb77f3
  3 e64b459c-c57e-85dc-865e-de05501ac1cc
  4 2474914c-a326-4ee7-9b9d-00e13d4e86a6
  5 cc918ec3-5059-362f-8195-ca54ffcbc5f6
  6 3a7fe449-15c6-333c-96c0-fcf547aba7b5
  7 533a487c-281a-72b2-9960-8c0d87cc6add
  8 e9790637-6ea5-0dff-975c-98ab25b1f6ca
  9 efa7da05-0f8a-8336-9f5e-9ffb53e07932

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 188433708. Exactly this sequence comes out of new Random(89).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 8 (seed 593,707,075): new Random(593707075), Next(8,24) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:59–19:19).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related