201206260828 vmsbr

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 47

Metadata

Post ID: vmsbr
Title: 201206260828 → 2012-06-26 08:28 on A858's clock
Posted (UTC): 2012-06-26 15:26:21
Timezone: UTC−7 · title 08:28 against posted 15:26 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(47).Next(9) ✓ verified
Run: Run 1 (seed 1,054,668,128) (seed)
Draw: 4 · predicted N = 10 ✓
Machine boot: 2012-06-14 10:27–10:27 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

3A452035417B6E98 62C116B1D8237AFF 075AAC43F7FD417E CA2CE70A6C62CB0A EBD25BFF93E07EBC 6F35C1FE159DCF20 44EB5FB8072CF259 61B8BC78067203AB 39F9873BE45FC79D 75B5AB1E54AE3A75 6C774FFF409FF0EA 34DE27157904B0C3 EBA71209EA0948BC EC713FE2CD384AA5 4EB0A2DF76515765 FD5419F4C9ABCADD 132C7E2A68E4C0CA BD4706EB745453E8 8E10C73CA6A73904 05E8371F8436960E 79CFF248BF1BE2E0 7AFEA3FE1B598C54 10B45255D83B358B C62629BE6CB7CE5C 906C9330F4DD2088 25AC6895D09B6591 EFEF27F5DE170EE0 97687530D856B4FD 3C30725870574C3D 379A2DDD157B24CE A1260B7E27E1884A 1A5451A3AE01153C 024DA41852663257 F0109802A523FE0A DC2F55CC67BB4D67 3737689C943A824E 3B70F2239BA1C95A 69036EBF410D4819 486347D6F8811631 B4C75DB1A4C0DE11 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ac5781a5-f46e-2a1c-b80b-be5b8a365bfa
  2 460a2032-2544-55d6-a152-dba20a15c825
  3 e2c47c17-bf3d-5627-ab9b-8bd7ea6844c0
  4 8b9d95df-cb17-502d-94be-5382f9cd72c8
  5 6ee01e49-cc82-384a-8290-f51f3e6c6a09
  6 c4d5cb94-a8bd-52f8-a155-10cb5ce00839
  7 d39c91c9-affc-88cb-85bd-18ee16c32798
  8 6efc5842-b3a7-0ced-ad25-f478c7cb1bf2
  9 856f2515-f179-7630-bfa3-644b3d405753
 10 303756a8-8652-5f99-893f-146e20872568

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2555358075. Exactly this sequence comes out of new Random(47).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 4 of Run 1 (seed 1,054,668,128): new Random(1054668128), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:27–10:27).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related