201206261109 vn2fl

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 467

Metadata

Post ID: vn2fl
Title: 201206261109 → 2012-06-26 11:09 on A858's clock
Posted (UTC): 2012-06-26 18:07:46
Timezone: UTC−7 · title 11:09 against posted 18:07 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(467).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 17 · predicted N = 14 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

EEE8066259F29955 35216BCE4A99D5C5 8C5AA6C30122C9FB 43D60353DC049FBC 182A58F721A76220 D7632EE601AD8126 1B5C04DB30C402F0 B1ABEAB2CED3FCD1 28D241E5F3A55BB3 983A3C06D9846985 F179DCD8C9C18645 F09AB3813DC3025E D86C7026DF02B592 AF0EFA78F0ED731C C964000BD5E5021F AC97675B2AC11906 104D48B8AB421894 F83C23DD0FD4664D 05F890D18A180346 082AFD475F89F84B 5235D7C23C9422B7 5BE27746E7131A17 4C2715D15AD8C52F 8CAB06F3F3FEBB82 602D58B2237D377B 5513207FF8B4FA76 265941F57BCC2500 C2B377A78E79E11B 7EB33A5EFA5294A8 478A037CD9534C68 ED198E40F74D08D3 BF21ECA258ADADBE A8A3628746364D7E 9D0BAF5F89F7A2EF 224CC42ECF2816FB D6F2C724BAAFB64B 8A0FE472A9C98F72 B38BEA825D040857 1D9FADF16396CCBF 283090AB63E5BD43 3602F40D6CD393C3 375F139F053591A4 F4414D81A05F84D9 467178339D00D7A3 F7F15E57AA057CAD 5520955876A91AA7 DF9F32F952F02685 0A5ECC70766D49E6 ED194233FBDCDF22 CBD8C03B684F57CC 12D86C181CF20005 51E99DBE9359624F 7079E0D054F8DC50 C91CE13274A98430 536F6AEF5C5842CB AD279DAC76D8863D 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3d73e956-f040-6f49-b974-bc8bcf51fb41
  2 a6458d0c-beea-7dad-b48e-f74d2561910a
  3 147a2510-caab-1959-a74b-a7122a54212e
  4 a4a40b47-3df5-22e7-b974-b2359b87b164
  5 d9980f36-543c-02b8-9a37-13d42aaa5225
  6 27f606a0-19fe-6092-a4dd-48348cccc2b2
  7 49172183-275b-1aa7-b745-7576c3c2e7ae
  8 7996b1e9-5325-6f38-a8f2-cf2abd964697
  9 7f8e7e61-d3c5-67d4-a328-0bbdd0c89066
 10 025f70a5-8505-4255-9721-922cd0ca90a6
 11 06b68dd3-4f22-3805-92f0-25824c67502f
 12 8f42b1d8-fffe-0204-b364-563760388028
 13 d8605b0a-2947-6ad8-9ae7-5321fc0e7a8e
 14 d28bf3a1-3b6c-3a74-bca3-ad94947fb717

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 67120616643063. Exactly this sequence comes out of new Random(467).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 17 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related