201206261132 vn3yr

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 553

Metadata

Post ID: vn3yr
Title: 201206261132 → 2012-06-26 11:32 on A858's clock
Posted (UTC): 2012-06-26 18:30:25
Timezone: UTC−7 · title 11:32 against posted 18:30 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(553).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 30 · predicted N = 14 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

DD5ECD22C716B6AD 852310961722C62E 3D3ACC22AFBB4D06 FC1F9B98D54A86B1 19924AC9AF40A153 2EE147AD281E83C1 AAABF62ACBBE889D A01437196C0D91CE A2E20C5A789609E4 73FBACD309C57D9B 261803794C5B11C9 14EB24B59B7DBC0A F449C9B8CC99EF5B 6093D3799BE2B16B E181046464F3B564 DB9F0917091786A5 DB201508CD86BE55 CCDD29FF248E8A32 67A223238122D09D C332A7EAC04F5BCE 163264C0D0024339 002502C207C4C7E6 232E742B22149E6B A89552162C77C6DE 690E026E59CEC81B 56416209F09D1B71 218D5EDB16C47770 B1107FC8CBBBE250 BCD9D3BDF6742457 0A841FF24417EFB4 E5DCDFBE91490CD9 A54DE71AB0E1CB9F FE587BF65E55A077 1DF9C4270CAABAA9 BB5DAA6D7A8852D7 C267FAD9AF60D22F 256A47913E1CFA64 BFB59A41F67A0AF7 FFFD00961F1DB5AA 23D01FE03847FDB9 108F0A5FDAF3433A D0420887D35279E6 83BFC3F976D42D45 916DDD4DDA91E7C5 5347687CB00C25DB 2A48CDEE15B4EDE0 D0A302AAE11FD6A9 ED4D3A3E3B3AE007 AC54A764FAB2AA9D DC9DBBDCE9C822F6 7F9BDB1602B60BD1 951B4CEE119DC93F 2E2E2B4C6A03738D 155E449EF429218B E24DF150E22E892B A87BCEDD50A04272 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 bb793e9d-6203-5d57-98d9-a4a173abc1eb
  2 2022861d-5ee8-0a07-a10a-49eca20f7bed
  3 e9cc409e-3842-20d2-ba67-9d245023e84d
  4 2da7840c-5e79-50a9-82d2-989ebb4852ec
  5 4b68ca58-75c6-7c08-be98-4409880c86f3
  6 b4988110-f7f4-79d3-8075-79621cb43789
  7 25e6e892-886f-6660-8abd-3defc3cfe348
  8 0a09e691-47e7-7dcf-9334-bcf172e6cadb
  9 5ef4ac1c-dcaf-34b0-9f55-8fa6a83e845b
 10 18bc1bc6-68a3-1057-b742-5a05eb05e495
 11 b7b46b4d-c580-640c-a1c8-de73a465e600
 12 0227d164-b82e-126b-b9bc-4d2cdb636b19
 13 0122bf47-0217-7fab-b765-3d709e253f4c
 14 0808d4c8-5f36-1ca2-91af-d1b3100e0c7f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 50257767316171. Exactly this sequence comes out of new Random(553).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 30 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related