201206261128 vn3ra

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 502

Metadata

Post ID: vn3ra
Title: 201206261128 → 2012-06-26 11:28 on A858's clock
Posted (UTC): 2012-06-26 18:27:01
Timezone: UTC−7 · title 11:28 against posted 18:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(502).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 29 · predicted N = 14 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

79A50F9CE1EC596E E6DD380663545F49 5D10034D77987868 C9B2E4A806B491E2 3495A6B0C7E7A7CC 6D421CE37DBE50FF 101945C7775BE03F D8148B65CAF55FA2 C3542633356CBBCA A522F752B669FB98 7A00EA0CE1A42791 FB40313CFEA739F7 A427725A2B150E7D BBCA561B3E4505A8 AA2D17C52A7C121D FDF45C640FD3B460 9F2FCF79D9059B1D 45EC930282AE9DAC 6C818B8CE1F01EE2 99C0AB08E87380FC B9349DFB9DEDFEE2 5A9B3E793403B671 E11898F12A91AF79 CB0E4BDBCA800F72 C06F50E5EE13ED8F BCD071B2D49D47C7 3A192EA465B2D525 C5130C399707971D D6FE7672CC9A1933 6B44E3D1DACDC749 5EED7CB23F00C1AE DB9B23BDA275623D 5CBFD70D82B3BFB9 1B9C4CE609482FC4 430B094375C3CAE8 9576C9C8B3635A4F DD0C73A2BC9E0881 F006499EB823F3BB 3EBEAC7461EC374E EFB000792C723354 960FF015E908FF58 94ED612B7A988028 783737BADD85F4E5 0635B2EE3C931D4B 5A40B606B570CD09 B260926B353BC151 027E71923824143C 8F0C58D30B1683F3 8DFC602ED68FA91B 640AA7395B01F9E2 BB459C11E71DAAE1 82C11165888B4E3C B800C6C3E9A02F65 FF81490ABAFC6129 1A52C0FBEB6F5217 B1A31E4C324DD506 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 dfc0ac3e-96fe-8227-b660-46c4c743d54b
  2 04945c63-5078-1a38-b19c-7c94bacb809b
  3 3cb555a9-1e39-5ff1-9982-683b990ca0e1
  4 55bdecac-5120-63b2-8596-f667f4ba7773
  5 b5a123f6-cab3-753f-be6d-31a435a292f6
  6 f7399314-6e15-29a5-9cc3-51d26dd5b029
  7 55b64306-fc8c-74c9-91af-2f2dd0f7e6e9
  8 2e693e97-2036-29f3-81a1-5d1052f70dad
  9 8c9c6510-bfab-0086-9927-b417422b5b79
 10 8e4c5641-2c67-3754-9338-12db9bb5e14b
 11 2cac64fe-a12f-10c8-be1b-1c77ee67e89d
 12 fe1b794d-0b9c-3286-83d7-0780c169f362
 13 3d8de76a-48ed-60ac-b162-7b6651d0f1df
 14 9779c857-b6ea-5b77-9c60-84a473490227

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 81567272031365. Exactly this sequence comes out of new Random(502).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 29 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related