201206260828 vmsd5

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 47

Metadata

Post ID: vmsd5
Title: 201206260828 → 2012-06-26 08:28 on A858's clock
Posted (UTC): 2012-06-26 15:26:54
Timezone: UTC−7 · title 08:28 against posted 15:26 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(47).Next(9) ✓ verified
Run: Run 1 (seed 1,054,668,128) (seed)
Draw: 7 · predicted N = 14 ✓
Machine boot: 2012-06-14 10:27–10:27 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

0E71FE0C48E042D5 FE2FF220E05ABB71 EF4E946750183933 3011FE6C7A4AB60F 004A8357FAD66ED7 61655128B4FFA947 88C10F6998742EDE DD50B442744B1852 E9F34240DB5F42E5 68B10AEE88F48C5E BE65B32E75B8DED4 46DA6171042B5188 9B05FF17E673F52E 588397884C81CA97 0ADD02C6EE5B56D4 8F3331CCE12E17B2 F3978D22439800E0 393DBBD6E3D916E9 28EE0F37E2D810FA 0C4F622EF32A384E 2041EC7E986EA515 0D725B4A5EDB47D9 63938B3EBDA1669D 90AB9E9C252C6716 ECDAE403C24C66A6 5AF6E4AAFC119944 81BEEC5CD7E7F920 86D4121D2C645DE6 B29763A894D1B57F E639020B57E06AD0 5546881E403CB0D7 A2355D30101C2137 DA97061844521699 1CE92B7AB107A7A8 604AA7EB404EE264 78E36F203C8B8535 28F6D2FFE1585C39 1BE52DA3E32C8CBC 05051A0F65B3F385 291B36D15114CC31 4FA9B3C9F2524B65 C2D4387160DFC161 40D716A546A8086E 15CFEE26568000DB 37C0BD7589DD395B D31C3976F4369A89 6142061F49471B2E F2C4BA68215B1792 1CF998DAF287B31B 5DDF612558C68164 CFE4B340885280CF 67B645FBBD518A38 FD3D442DB22F2490 F4DBC311F6B9CEFE 9D79F0B5EE5643D4 6A27803D219FB9FE 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ba23218c-f04d-27b2-9cd0-af2d76ea600c
  2 cf8ebab1-9fa0-55f8-b310-a91c34081b7a
  3 55609293-da4a-58ad-a7c5-1f83e241c0f2
  4 984e3f89-e814-54c3-b750-4bacf4d0ce66
  5 2c876dab-7253-373b-90bf-60301a0fcc21
  6 1d2467ff-7fd1-5498-aa12-a36aec54899b
  7 aa1ebc8a-171b-8b6b-8b70-1a4cb3554291
  8 abeb37e7-9b82-0e58-a794-ebb942f435f7
  9 887cc1cf-62a3-75eb-9428-af116d2f1a3b
 10 6441d7b1-713c-57f8-9006-72ac8c57cc20
 11 eb486111-afa0-8ba4-be9b-f1081d346546
 12 33ed2d7b-cc19-11f8-ba8a-40c1f33aa256
 13 b1547258-a911-8c48-b3ae-c51f07e120fe
 14 989e1299-c4c0-86a7-a76e-fcf9203e3e5b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 25553580758188. Exactly this sequence comes out of new Random(47).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 7 of Run 1 (seed 1,054,668,128): new Random(1054668128), Next(8,24) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:27–10:27).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related