201206271309 vpao3

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 734

Metadata

Post ID: vpao3
Title: 201206271309 → 2012-06-27 13:09 on A858's clock
Posted (UTC): 2012-06-27 20:07:40
Timezone: UTC−7 · title 13:09 against posted 20:07 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(734).Next(9) ✓ verified
Run: vpao3 (short)
Draw: 0 (assumed: numbered from the first post)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: short

From the post to its content

As posted (encrypted)

86ACE4BD748311C0 12F09EC3EBBF8FB8 7ACE313FB5A33C0E 37D3646913D7BE8A CBD2658AF0A88FBB 705E092F50BFB9F5 F84ABDB6601C067A 5B94917399D1CE1D 1BD5DF45D8F5B519 E8776E2F1FFD54AA 006B938DE94060F0 4926412E33EF424B 946656FC186F3E27 5029636A8E4588FF D4B0A5C3631766F5 544FE6E745BC3393 07EA3F21223F1302 77187711BEA21267 F66901E334FF57C9 C35F5C52D2B94F95 3B5E0AA053EC09AE BD4EDE4B8A6D2BFD 7AB0E9D599322751 39660EB05244B22D EEA083632A639E80 6DB09E09DF00E5C6 F31E65D06AA9EDA4 98C1919F3FC92602 1296BEF748858F05 DC388A0DE995D74A 28C33934ACFAF7E6 A786D36373D00839 F4E89AF0F8686ACB D4656187A99D67CE 443FB21C46608BD7 6ECDA298AF2BC1AA 9E44A7226EB717E6 2C1EAFE5ED366344 84E9F358F5D34787 7D99E82BD0B03F98 C91C0AFBD611F4F5 EA0801F05CDF2C87 5B682D32B07225AC 8BC74848A1BCEC44 C9A3ADFADDFB51F0 B1184ACDDFA8235F E4C2CFD389CE5F3E FCE7A2E62B03B072 40914E772E1F50E2 A19AFF3A88627166 214C5F61CF8D009D 9571944499ABB80B 414D236BEC436AF7 C283D79B44A26D55 47F7F29AC795815B 74B754813E752B92 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0a2ea467-f715-17b8-b19c-2e91c8c0b7a0
  2 09ef4f5d-c1ad-1c8b-aedd-bccba288f06b
  3 9b522b93-86ce-7a13-9538-7a2cba319cf3
  4 284f5696-6fd1-2106-a7cb-f1904027e587
  5 91dfacf1-485c-5a52-9649-6dd8fd912a1d
  6 f5ff5803-4713-842a-bd63-d61fc827a14c
  7 e0ca64bf-a71c-79a8-9177-ff997e9a8947
  8 6ee55360-1aad-62ef-bb0a-77757a00bf00
  9 9c0635c8-61ea-7800-8bc8-bb157b4d91aa
 10 14ffa7f7-9b6a-8489-b7a3-7a64014eb17f
 11 68cb21dd-d9e6-01b7-b1f2-6b67b0fa469b
 12 b5e7d4c8-9f57-4e58-84d9-2956e52c18b2
 13 a39e6530-07e9-127c-a99e-16b2b5522927
 14 2076013a-a310-3dd7-94a8-e482feb99da0

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 11725876780413. Exactly this sequence comes out of new Random(734).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. Grouped in vpao3: 7 posts (40 bits) with no seed under any tested model: not Next(8,64) anywhere in 2^31, not run 8 with a new range, no fresh start on either June boot, N not from the GUID-list seed
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related