201206260829 vmseg

explained decrypted filler

3DES(name) ECB, 8 GUIDs, seed 515

Metadata

Post ID: vmseg
Title: 201206260829 → 2012-06-26 08:29 on A858's clock
Posted (UTC): 2012-06-26 15:27:26
Timezone: UTC−7 · title 08:29 against posted 15:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(515).Next(9) ✓ verified
Run: Run 1 (seed 1,054,668,128) (seed)
Draw: 10 · predicted N = 8 ✓
Machine boot: 2012-06-14 10:27–10:27 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

6F06E6A150F49C0D E280AFEFFF42C5D1 E93FAABF01CD8674 9714401800693BAB B62D9039418BC2FD 62C2E112F0CB5B39 E928694B1EB39395 5AB928031007C834 F5EA38089286E0D6 D75760728184A04B 322735A24C6AA0E8 34193193FF47FC56 E6F9802A4C440540 3A7993D60F6271EF 164253743F642208 3A77DA07A93C269C E007C9E8FB7C148F 2B136DFA3AC29F3D 3141709F449EB0FC 0F60A9E513739197 59DDDA3F8290166C EBD37F46DD65ED19 A1E2F039E4E56D5A F9E390A911984F2E 5BD1088B9556F090 EAB058B44BEA6600 F3558FF5DF380F36 E856EC465CA97D24 AD1E4ADCC3397C36 97FD68444A25D248 5DE121648F5C8882 9590AF28D925A0C7 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fe28df84-9c1d-66ad-87ff-41e31d75d982
  2 50fc4c09-df5c-8aa0-ae14-51b31f774dc2
  3 a8597dfa-5d45-6454-8954-28aadab0a0db
  4 5be4f6f1-02db-4f5e-85dc-1baa3a02ec5a
  5 a78eba42-b9e5-65a3-b255-aea270c30fe4
  6 0f054284-0288-5d4f-9874-2d205ba01c58
  7 81e111f2-9a93-5992-8f27-83551283617e
  8 34f52961-a6a4-7e0c-bb90-7f2dacd8bdd5

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 68646557. Exactly this sequence comes out of new Random(515).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 1 (seed 1,054,668,128): new Random(1054668128), Next(8,24) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:27–10:27).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related