201206260926 vmvtj

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 949

Metadata

Post ID: vmvtj
Title: 201206260926 → 2012-06-26 09:26 on A858's clock
Posted (UTC): 2012-06-26 16:25:15
Timezone: UTC−7 · title 09:26 against posted 16:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(949).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 12 · predicted N = 10 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

E5F649C2B26A1CD3 87506E2497D7BFF8 C929CCAC122061A5 2D5C88510DC278B1 23BFFEBBE7372683 CE070FDBA6AD0022 81775CBABE815CF0 9019DD2A0AACEDF1 49B5C06C17E60813 151A9F8C166E63B3 388118BFC6EB42AA 7D721A3108A84652 7C6DD764755C7CC4 75822EBFA63B8D81 A97DCB53B532E0C4 08EA78939A8A4E8B 1EE9A48135321DCE B3BF12DB4AE94C84 8683E690AC0C2E84 2C87FFF625CA00B3 2A6D5AED7B323F73 EC0D1BCD74D72C80 F2695E9EB65A688C 7FAFD3BBD9B715D7 7FA5F70DBBBFD364 F3A59D8C96E96013 EACC28446F253134 39C1AB3CF19A8EE1 73D3339704D46318 F0DF37BF09AB6619 356C3D86D2375B7C 81BDC35D27B3284C 2B2610CF82BDF225 33AA6BE78CB3C5A4 F73356DC9EB6D236 593FA24DE9404193 F045BB83E3D35513 BD330779210CEF89 1AE57BB7BF0CC329 3256730AF52F7FB9 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4c8497f9-684f-45e0-9f43-414667e21b60
  2 62988b2c-c0bc-28b0-ac05-3e15c8396a66
  3 17df5d02-25b4-07ef-8e66-a4ea543590c2
  4 f79e16e9-f1ff-1179-9225-2151cacb5c91
  5 69790b87-1531-513f-a298-4c1aed9dde25
  6 0d8ae480-8552-7350-905f-772bf947f71f
  7 ad85a702-9ad7-1831-9fb7-acbe46acbec1
  8 d13064a0-32ef-4f8d-911b-11bbf6e68029
  9 9f7f1091-461e-3764-b7ef-35be58f5d52d
 10 ae816064-97f4-10ae-8bdd-3031ad7707b6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4201571431. Exactly this sequence comes out of new Random(949).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 12 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related