201206260828 vmscm

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 114

Metadata

Post ID: vmscm
Title: 201206260828 → 2012-06-26 08:28 on A858's clock
Posted (UTC): 2012-06-26 15:26:43
Timezone: UTC−7 · title 08:28 against posted 15:26 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(114).Next(9) ✓ verified
Run: Run 1 (seed 1,054,668,128) (seed)
Draw: 6 · predicted N = 14 ✓
Machine boot: 2012-06-14 10:27–10:27 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

669B664A9029DC4D E8B294B3EAEA538F F424980710DE1D8F 0594B26B770231B2 F210F40687630F3E ABE4B9E66E460F0C EC8CCE52F4FD61B4 EE8ED2EDF05DF819 904B2362C82FBAEE E634ED35041AEC28 0BB19CBE38A6C990 DA78410DB67F5E7A C1C486C02A7A5EA6 3BED3D22F4A94561 BDB11381C7E5FB04 AFCCE13C68EC5AEC E8035C802EFA77E7 D139E3AF0F4C3DF3 F33BDAADCEB8E685 7CEC56C575E4D652 EACF08B9C8AF06E1 C72F5A865D58AA9F 63D003FCD89D561F F2BB57BAB7D667DD 86AE3B75BDEABD97 A73B23D284171D4A 6A639618D1AF74A6 0004A1E777B19178 5A14BEBEF3C48481 9D4BF126154BCFF6 B23110F8B7E01988 7B556B72D034DA43 6A7CD4A2AC3D4744 273E4C2D8B71EC15 161FDBBD72E4F1E5 53424E1F2CB1F605 B823103426D41299 FC58ABD011162085 7AF5407BA82EF6C5 44377D828F47CB91 A5B917D9C16DCC57 49307840FBF1E656 55578D8C719BFE72 BB0C96A21522E11A C1E32C572131D500 203E0284F214F91D 56FDA6682B36DE46 FF68FC55D5B2C9EF 933437D5B04FFFC1 5540A81605B4C752 4951855FAC235596 A803F95CEEF0EE29 49E3488D31C3D815 0482AC030DC01CC3 E9C007208B366868 B56FD546FBD58E4B 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b35e8356-4e8c-21e9-8998-4f67ce5ebf7c
  2 25de7d70-5426-2235-b7f0-9778200ed766
  3 1b1e4532-1c0f-4a14-84d9-2243a6cc89e7
  4 7282e4d2-a203-8224-89bd-e77d213d593b
  5 27d5555a-8e63-60a4-a49d-b201a76e2bf1
  6 de904cc0-a6d8-16eb-b118-11e8971739c1
  7 6ba84842-89b3-8672-acf8-38102e627806
  8 01e4a8bb-dc22-5bdb-9a94-43ae9dfc1942
  9 b548bc7a-379e-0487-864d-7b54d11b563f
 10 271176a6-518d-2cd5-b779-cfb569141845
 11 abae4dde-e5dc-25b9-9728-243d1e136400
 12 39e0fa47-616d-4f63-b329-ecd2c56c635b
 13 98c988e9-9b98-0100-bdb8-a93c48d999ea
 14 55468b4a-d65d-7392-93c9-d3eca2b31be6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 22486185022407. Exactly this sequence comes out of new Random(114).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 6 of Run 1 (seed 1,054,668,128): new Random(1054668128), Next(8,24) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:27–10:27).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related