201206260828 vmsdx

explained decrypted filler

3DES(name) ECB, 9 GUIDs, seed 608

Metadata

Post ID: vmsdx
Title: 201206260828 → 2012-06-26 08:28 on A858's clock
Posted (UTC): 2012-06-26 15:27:15
Timezone: UTC−7 · title 08:28 against posted 15:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(608).Next(9) ✓ verified
Run: Run 1 (seed 1,054,668,128) (seed)
Draw: 9 · predicted N = 9 ✓
Machine boot: 2012-06-14 10:27–10:27 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

5689A343F39B904B 0E34480814429BC1 CDA6A667FC353B3F 31265AF21884F02B B0D45A0AA2FC5277 F0A0279870B2B107 DF1D15C0FBFF80E0 24A5F473F8C35114 CA15CD9F6A6AAA11 BDBF1E10D02745C5 127B5CBC04E50AD8 16162C3C6A1F79DF 6272C4D28328BC18 93DE5D7A0D3ECA4D D3986F7FD23A0D3E 5AAEB4DAE7848CB0 0330A699B965762A 4FD11F3DA1055257 6282DDED49683536 D7B12ECBFE4D7077 930C2B7A96262FE5 355AD4650BBE83C8 DB26C896FBC6B8D5 D75D1FB2BBC89A05 F9B3A66215FE040C 4782B74F10B06272 84C9D040ACB8A111 1DEE28605A604524 868F71D4B3500E04 23E8473E9C0CF4CA 7C76CEE50EB205CE 9481946FCD4F9971 711EAA14FB184DAF 65416780BF1C0DD3 5D2307D238D10740 FC87BF0A6747B4B3 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5a8dd4ab-da95-38be-9cd4-bfc5db4d1bdb
  2 ae36845d-eef1-15d3-a66c-8ae48774d8a8
  3 9654456e-f809-6003-9596-22ee5f82c5ee
  4 a3c19246-3824-275e-801a-bfae57a27f2c
  5 fd17f5e4-a63c-635b-bf70-47132791406a
  6 526cf2e5-72de-7a36-8e78-9a14c4b22888
  7 e5050179-de35-2dbe-9d93-96d15c9b0398
  8 b1eaf506-e8c0-4367-bf99-81db2758fa35
  9 4a6210d6-7b9f-1cfe-8ca1-0feb46cdee5a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 316267241. Exactly this sequence comes out of new Random(608).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 9 of Run 1 (seed 1,054,668,128): new Random(1054668128), Next(8,24) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:27–10:27).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related