201206271509 vp6lb

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 783

Metadata

Post ID: vp6lb
Title: 201206271509 → 2012-06-27 15:09 on A858's clock
Posted (UTC): 2012-06-27 19:07:31
Timezone: UTC−4 · title 15:09 against posted 19:07 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(783).Next(9) ✓ verified
Run: Run 8 (seed 593,707,075) (seed)
Draw: 11 · predicted N = 10 ✓
Machine boot: F 2012-05-15 18:59–19:19 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

D261CD5D635C46FF FF99428FF070D809 948564CC33A65C74 A527F7A6DC78B150 52B8A0456426F1A6 ADB3B85E548D5336 3D89D62D4CF1C499 2230D8D37310FA1A 4F8213BA5CBD350A 89A7372D0F5F9323 B4AF57233E221915 71C1D1D629BE6F35 98B2FDBB11576BFD 97F359C23A2D4FE3 9779636659DFDD17 062BD84341792AFE 8B6BAB7E85FB5A15 25DAF84EC0E1AE80 F3DB308EBCC17023 0EB375C2C71A997E A9EDA903581CBBA3 7CDD62EC8DF7B8B0 FAD541765BB7AFAB B91A80FEC3170D10 F541FC0CC77F1BEC 80D80FD8A68D64C3 3C352F6DCBCAAACB 89180A19635DE572 BD92BAA8FA2EBE8C 4AEB0A90EC060CA6 1831581EB9CA50F7 65EC52D7F645428F F749544C2CD7EEB0 C919E580EA2477FE CBF409488216417B 0C5EE74F0A2A605B BBA5CE557685ABFD E6EF2939C353E250 95533197240EF5B5 EACA82AED021B063 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c8b4e2f9-588c-7e95-a54a-fa5e697e6f99
  2 35ac331c-b459-5012-8b84-7a8d79480d45
  3 cefc4966-06ed-0559-9336-856a1d463741
  4 8a9169d8-7035-663b-8bc7-680596ae93af
  5 f40d989b-09fd-6a81-890b-1aa7c2ddef33
  6 0215d17b-50fe-75b7-95df-9f69bb7abb23
  7 c6ffa35a-8c00-684b-b6de-56a5905ef212
  8 028cfe6b-f6cd-2d45-b9ea-18bebe75fc3a
  9 cd4bbf8d-244d-760b-a173-a04392d67a67
 10 0befb7b5-a281-09d0-9e4c-aa38f7feb7f7

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7506676270. Exactly this sequence comes out of new Random(783).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 11 of Run 8 (seed 593,707,075): new Random(593707075), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:59–19:19).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related