201206260828 vmsc9

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 952

Metadata

Post ID: vmsc9
Title: 201206260828 → 2012-06-26 08:28 on A858's clock
Posted (UTC): 2012-06-26 15:26:32
Timezone: UTC−7 · title 08:28 against posted 15:26 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(952).Next(9) ✓ verified
Run: Run 1 (seed 1,054,668,128) (seed)
Draw: 5 · predicted N = 14 ✓
Machine boot: 2012-06-14 10:27–10:27 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

69378FB82E66A6E8 0333BB6C7761543E F76B2CF7516BAA18 3BB9E90EED9FD118 3D5A6A4E42C8ADEF B5BC2DB8BF7408F3 4F2DDB9D17505E53 1EE7C021564C0197 B0E6FABF1BBB9B8A D612C6419BDDC774 1028B45F97F83C3B 5CCCE11676775526 5A35DAB7A48E9A67 F070557B5F85FA16 D6B1E9D401C66C7F F39EB01BEA44E25F 278680DA7D7F10EC 1CCD24372FFD3448 6CB04D57320DB66E A58C7B849D9287D3 E0B1B2CAD8F3195E 838EFB31A14E48BE 3E4B0B3DA14D7ADD A27FF91113D9BBD8 D36CB6B7C7FFECA5 1EEDF46B87C8767F 84DAE11C2753E84C 59FB4068E83C5F95 A467C17FD791B6DA 95D32690F8B5825B 731D76B5035A803D C66C4FC00A87B02C FBB7B0ACC5C72F9E 8FA2F2A485FFB1F4 328C0D273DBECFC7 9A14D023784749FA E0CB61300698B8CC 575D32D54C1465BD 19913A0B1A2C2609 502C51B62CB9D00C 513970411957E9EB 69944A3E7C3714F2 324549D7F8175986 1122934E6BE3CA0E 26145664F974A6E5 67AC635DB76BEAAB 3A5F46F6D5219441 89EED14E5BFD3AD7 8E4663A6D3E772F0 C37B3FB34332490B 01D5B8954FB4B5F7 0CDCD9054F33E37D 45A09F186E712466 9296299140439521 B2B89D954FFFA329 DCFE08CB1A3C6BB4 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 27ee9284-0dbc-04e0-9674-955aa3eb7ada
  2 97a96742-6dfd-1ac2-a117-928c5114ca62
  3 1781a936-ae9f-1d36-ae59-23879df214b9
  4 f77f0686-3415-6f88-8607-8482c2286682
  5 394842d9-1235-0588-837d-93fbaa0194e1
  6 24d5c990-a2c4-4733-91d2-bd9196a75dfd
  7 d311eff2-6a38-45c9-b686-9699d9c6f990
  8 7980f7f9-d94f-0935-95be-828480f9213b
  9 783bcdcd-2065-6fbe-9cb9-7d6ae047e01d
 10 62b858ef-26b3-2297-9d85-369e732fe8a1
 11 13c8c04d-758c-5b10-97ee-fd8d053fe922
 12 2c05a485-a5c7-6c09-80ec-5623f7f03490
 13 bb609b7f-848b-092e-ad03-54da5a6c69ab
 14 ac31fae2-c30e-6ee0-8903-86918677b9dd

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 01160440625606. Exactly this sequence comes out of new Random(952).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 5 of Run 1 (seed 1,054,668,128): new Random(1054668128), Next(8,24) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:27–10:27).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related