201206260948 vmx47

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 591

Metadata

Post ID: vmx47
Title: 201206260948 → 2012-06-26 09:48 on A858's clock
Posted (UTC): 2012-06-26 16:47:03
Timezone: UTC−7 · title 09:48 against posted 16:47 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(591).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 17 · predicted N = 12 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

C5BAA73AC05A213E 7AFF5DBFD72CDBBD E0C48B8ADE09B05E 20A8EB1B1D78A9BC 8C78DB8820164C7D 411A0F605B84F675 20598755B585956D BD2CE1C924322490 E94A0EF6139F496E B93476BDD7A13201 7893E3AD72F08DB1 04C46E3A0FB029EF 571FEDB85C0EEC5F EE48EE2681388B07 BB52385259281BA1 0AF914266941FD02 C04908FAAA1872B8 245782780271D06B 85F69C6587C1E0A9 FF75450246F4AFC9 5C1671C0818F5358 7A461BA7306794D8 CCB9FF519E35C414 A602EE8AF14BEEED D54D66680FE66317 209127B85A7E5336 B32F175DF732CE51 2359B28AFF214937 54E6120A71D66025 4D4284976BC72F72 E8711E44040C2CB5 22DCCE69086FE853 14120E240E26D509 D0FCB91987FA69FC AD714123C5A0AF5A 65C591F713B61AE9 003DA9248EF89660 94790CA32CBD862C 3AA6578F30B1D5EB A69997C15FFC6E44 FE99853550E050A8 E6D0EE3907C06398 ECD0C00223B24449 637F1A9657143508 8B92164794723501 B00F513BC5379675 D70E9A007F1152F6 62CECAD5A3F3167B 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3c2d256f-3b11-4f6c-9a3d-1210fe53ebab
  2 22c68e60-f919-2a8f-ba9b-c7611039cb15
  3 1ee6aa33-2022-7fea-b10f-6b4ac0e6088b
  4 04c12923-a06f-6121-8ec4-b2488926a464
  5 254154ae-9447-0bee-9508-ec708c2c8aa3
  6 803ecf9f-4350-0f62-8fbc-6ed6df3430ef
  7 ad93abf9-3615-6682-b62e-5478c4df05b5
  8 fadf3457-0bea-80ff-8882-5296d5462f57
  9 389a617b-dda9-0669-8610-ee92b4cd7054
 10 8951ca90-4678-1129-8f57-4bde3b973760
 11 b15a2c16-c8a2-6b92-aa9e-fafa942991e6
 12 8fd01465-06bc-7199-8111-eecfd3af5062

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 427600680167. Exactly this sequence comes out of new Random(591).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 17 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related