201206261120 vn36s

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 815

Metadata

Post ID: vn36s
Title: 201206261120 → 2012-06-26 11:20 on A858's clock
Posted (UTC): 2012-06-26 18:18:56
Timezone: UTC−7 · title 11:20 against posted 18:18 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(815).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 24 · predicted N = 14 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

5D81DE90C42E5304 EAE14A509B02DA13 2C2376B3B7F60DD0 AEE8D357A2F6C7BF 53E9798F053FDC7F 983C776D6AF855EC 52EE8FDEE2FBDDFE 7AE41647C2A66F43 650C285707C0BE83 BADD3EE59C2A4D35 4BF8A9FF8F649761 2FAE42761D9232CA 4BE41016E9955DC4 0A34867F652E322A 20AA76E12CA8200B CCC3DD929E037129 32E7F470B6BE362D 86600A03B770A088 DD8C9A8DA23D491A DC39578E8E4C184A 384A4CCC19530880 924779546132D6C0 49C8AFC6DEAE45A2 F31851F1C6CEC57F 034BE13E69847963 257D031F81CA1B5C DBB33F0439EFDD97 61F168E0E5CEB899 17FCE20F88147980 71F4B204ADFC281F E25CC1058DAD842C E14A6140FF539CC3 0BD0CB1E6766C17A 4C2E580DFD4B4CB4 0AA492BD06431A1A 54054E1FA2349960 EFABD980B8CE5989 0538B57670543CF1 E7FC7D38B12FC845 2701AE83D17C8AD4 88081B3063F6CE2E 89A21A4D771D51E1 07B138FD75EB14CF 1A571D3CC315AB62 C875F82DC3FAB43F 5AD94A5D6FE4ED5E EB6A2FEB05230B25 1C218178C4AB461C F680B3053BA945DC 507104E33FEA5771 31ECAA83A93130EF 5A41C67F4A8AF231 3FA785D09197A4EF 9AD1EE7C229355C0 979702F3C2080D33 FC6DC427D704C3A6 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d721e144-e073-4992-9a7a-1106838bc37d
  2 727a2b2d-3387-8ed3-80c1-6f68d5f75b7f
  3 2fc9f0f5-530c-34eb-9559-14febe483ac3
  4 5b143844-fa93-4b83-afe6-f752e3e27ebd
  5 35855a35-60be-1b53-9a48-b66f3d261d61
  6 45511292-9d0c-7a40-876a-5e13081024ee
  7 e393e875-f055-09d9-92c7-68d63175dd95
  8 96585e00-bea2-2732-afba-0f51121d8d1e
  9 993e6e56-68fa-7de7-ae8c-1a26723e5bf6
 10 73f10697-1544-773d-84ef-916d727c2480
 11 78864258-3950-6694-b28f-1fffa0dd5e45
 12 6e6689e5-7b79-6e54-9406-c622d74da003
 13 9587673d-98e8-880e-a90c-b446fa0e4fb7
 14 77454eb2-99fd-4e54-b898-d72f847c6459

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 48341702776684. Exactly this sequence comes out of new Random(815).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 24 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related