201206260922 vmvk4

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 603

Metadata

Post ID: vmvk4
Title: 201206260922 → 2012-06-26 09:22 on A858's clock
Posted (UTC): 2012-06-26 16:20:54
Timezone: UTC−7 · title 09:22 against posted 16:20 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(603).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 11 · predicted N = 10 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

FC739C5085ECE967 23295B80D8CD1B29 F485505A3E1C2CA2 31769B357951D82C F06EB298D6194DDF 073150F3DC89B067 3492EAB4206EED01 558C440576D26900 74CB69C36B7E8E35 2D4A79B9FF01FD49 86466A99300FB1A7 7443B18059A79C4D 2F939A10071BF449 5A0056A87C171CEF A152A3192264ABB7 F417021B77B716F0 92DF95BCFD31D1AD 6F2A9FEC95912B0C 23F5164B6C1D1166 D087A496CDAC28A9 11373FCA1E16F4C0 ED1EF71CF2D0D333 34069768AF9198B3 7EE171D4C18E4F28 758C74444A3E0060 BFF5A421190A9F28 F50A11E6A42A7463 270BA6386C04A2A2 FAFD74D75D32EE74 C2E8FC237DCBDE27 6F81D1ADA6C772ED 010BAB7321AD5329 5DA600BB6658FA55 97931D571D33B7A1 A841798E7108C30B CC2076D47245D7F2 4CAC7592FEE48415 9B1D9FBA3D9B1726 00C67731D4F962E0 82C8196C219FB5FF 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7e6c9b83-0fda-6521-a841-3bfb7320fcd6
  2 b9d42496-5332-69f7-88eb-d21f60c8db7b
  3 27908485-4e35-2dd9-a9ee-a166330cb820
  4 30f15c32-7d46-2a50-838c-37fdab7c4734
  5 1aca06c4-940a-4322-928a-7523e5e65ca7
  6 ae2b5f10-e2e9-49b2-a75d-d1d0d3218040
  7 8ff8a366-1a89-0fde-a322-36f148df47d1
  8 0ae34371-fb8c-8857-9fa6-cf1e88e29eb5
  9 7e90e414-196b-52ed-a9d2-10621e2c6774
 10 555ac91d-40fc-58ce-bae7-d8623a240c07

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6622440855. Exactly this sequence comes out of new Random(603).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 11 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related