201206261053 vn1ao

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 331

Metadata

Post ID: vn1ao
Title: 201206261053 → 2012-06-26 10:53 on A858's clock
Posted (UTC): 2012-06-26 17:51:47
Timezone: UTC−7 · title 10:53 against posted 17:51 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(331).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 7 · predicted N = 12 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

754F82E7A387C68C C1437A930CEA6683 8F07E4DC3EA52F6F E28D8374C809AC5A B78B978277421F6F 62D1A3160B1A2DBD AE3D01DC72EA4FBA EE7FABBECCE0F615 BEF1C4F0CE621E22 48B0D2F96AA0956B 39C18069ED95EF44 8C21D0F55BF5DE52 6028AA64BD81191D A38E7C01C55B94A4 54EED20114B7ADD1 D20695DE43430F49 DFEB1F4332B29C18 7B6E39308FF92E19 7795A4263A010034 1D159EC932DF648C 75D8F5DB874BA136 CDD3DDCF8204ED11 EDDAFDA3EA60EC57 ED57177A740059EE 9695A7D138F08F3C 0CC57839ED149D69 6677B240DFB1C6F4 AFB0EFF1986B4CC2 6BDC5DB67BE420C3 ECAD5C56843DEA91 816BDB2459E69151 2ADD4C35E16C2DB1 43C3427F0C9C3892 BB41F17F21F9BC0B D444B0C947AC09E1 013850510E40A9BA 01E92597EEE17107 047068552FDDCF53 E0F675B7484B8E43 0C492EEB87299044 677211D61F3DC70D DFE95357FAD93DBC 9B995FF0F10D3ECD 7AFB58A7D9EC6C00 5E050F48DC6C0F07 08EC64183EE4A42E 08D676FB2C33C35C 785E4E45DE1CBB1A 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 66d2e27f-87cc-5fc8-a45b-c943b567d597
  2 bc947772-372e-8d48-b3a3-cc19542da5f8
  3 7dfdcda7-1031-17d7-afb7-4f5bb909a636
  4 cfa56481-47fa-1e63-bf29-3f357c090bf8
  5 9f8d97cb-d420-574a-b43a-d5b1ce939d5c
  6 8441ba55-1da4-7301-b30b-8f9aabe969b2
  7 bc33b06f-9cb8-1adf-9ffd-0c8e3d0ef0ba
  8 f5f58faf-3ae3-48bf-a37f-cbe80587f4c8
  9 df11aab3-df48-8ec1-8cbf-af5e830b13b0
 10 3f1b45ca-d4d9-2353-aa02-66abf5f3db11
 11 aec3352d-fd74-1a2c-aa4c-f3f6b208fbc2
 12 0bc4b759-47d8-7bf8-97af-af4b58629b91

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 581157148217. Exactly this sequence comes out of new Random(331).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 7 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related