201206290023 vsb4i

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 873

Metadata

Post ID: vsb4i
Title: 201206290023 → 2012-06-29 00:23 on A858's clock
Posted (UTC): 2012-06-29 07:22:21
Timezone: UTC−7 · title 00:23 against posted 07:22 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(873).Next(9) ✓ verified
Run: Run 9 (seed 449,725,219) (seed)
Draw: 5 · predicted N = 10 ✓
Machine boot: F 2012-05-15 19:12–19:12 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

727C042E0D20C521 AD427ECF6561DA73 81B545DE0DFF5B0D 1C464B98643A6A6A FF47C04A379B1332 AD22B785D150EE86 641EF12B3F0D9D5E 20B7CEBB70980691 0F9216DD4F486382 D7F0E81D13E3199B BD920688AC950A7B B670386C7B0D1A50 ADCD98FA0625C4DE C28690148E1F44BD 9782BC0FF554A16E DAD5A5A2D37CB498 6C4B708090CD6390 5B3A442452B19552 9E1ECBC8D501E170 DF7CF8F33827A45F 66559A98DF563FC1 EF212717136B0B0A 76B75D262C2447F8 08B8E8A6D740784A 08EE93F932C84297 27A0EA8271DDFBFB B017A5D622AB3584 E45A5E0889FEC6F1 E64ACEDA64683D00 66D507014317F651 8C5C02174D158301 3D3DB17124020638 68BD0054E5765FA4 F6C530049C564CC4 538F508DD43CD26D ED7C9A31C972A010 582138B8E67263C5 90659DD653C12E32 05E0574DAA6AA0EE A874745011ED0B2D 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 19852101-91f8-7b0d-9f19-a4c390a77195
  2 d6f39154-665e-8399-9790-1032974ca75b
  3 26cb1381-eab3-887e-95ca-c56802f67dd6
  4 86e41df8-b460-8783-bb41-30b04429b1c1
  5 2fb056b3-4594-3fa3-957c-98cef6e4d6b9
  6 2c90e1c9-c0e8-4627-ad65-3a5193be6bcc
  7 5fd5394a-4835-0135-bf90-be37c5b71bdc
  8 36ec86ec-ccdb-34cd-a9b6-79cc32994882
  9 a393686a-a181-83e2-8ff1-fb5be0cea5a2
 10 7ad6cab9-83fc-175a-b660-69d4b01f181c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7888340381. Exactly this sequence comes out of new Random(873).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 5 of Run 9 (seed 449,725,219): new Random(449725219), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:12–19:12).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related