201206261127 vn3nl

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 73

Metadata

Post ID: vn3nl
Title: 201206261127 → 2012-06-26 11:27 on A858's clock
Posted (UTC): 2012-06-26 18:25:24
Timezone: UTC−7 · title 11:27 against posted 18:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(73).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 28 · predicted N = 10 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

B6955003F3892B1B 24E356C8880DAD2C 8958FE6B0F081688 0300BB0467A82AD7 FE5474AC6D0D2B34 914128AEB66BC872 B84D8EA334D8A8EF 98A19784469673BE 6BE544E4D91E37CD 0967228DC5D2BD7F 41AB670AC55AC326 78C7084383C6056E C700433958EB3EBF 31CD6FD4766DD480 7FA2B34E108D7F8D 8F7D236468AFFA80 E200890807A438C6 E08BBC388A5120C5 4EDEDE72F77D5B69 D603AC818B7E00B1 C7D7BAE744C2AAA1 85683CBB188A6B96 7A1EE512188C7665 14AA1F9090F6DA9D D74C12C4DBFB2919 3D046D6A3B24DD0C C4B5DD7CC058EA80 AB5C800B1FCFF3F5 CA8AC4D130F47D84 873FCDD000F1B5AA DE81C466613DC021 6007B2B6B0B96BC4 750B65C128B29E0D 9B5DD8669CCDE413 7B8749FF40988251 3745E7584A91A005 8443E8161DD0FDD2 947A3490EF3D590E 8415403388D9108A 9689B3FA9CDC42B4 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 72021e62-2669-7af6-969a-f4627a03e444
  2 6c5fbf6d-fe41-2575-b315-2add86af5919
  3 6fb0498b-b495-7128-b4b3-af54b3add54d
  4 6b5a1777-7852-1682-b9e7-903fc3697a34
  5 32b874e0-100c-156c-9eea-aeadd4ff9340
  6 95913397-7b99-34fb-b694-840ab12ea9ab
  7 d90ebe19-a819-58fe-8b9a-80f2622a04ad
  8 cbe429a5-5372-0dd3-be1a-250e8f8602d3
  9 4875bb0d-b6b4-0493-892a-9a2d80fafd89
 10 d64cf1fb-314e-1c22-9fe7-4dad5bde66ab

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7271135001. Exactly this sequence comes out of new Random(73).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 28 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related