201206261135 vn47s

explained decrypted filler

3DES(name) ECB, 15 GUIDs, seed 969

Metadata

Post ID: vn47s
Title: 201206261135 → 2012-06-26 11:35 on A858's clock
Posted (UTC): 2012-06-26 18:33:50
Timezone: UTC−7 · title 11:35 against posted 18:33 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(969).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 31 · predicted N = 15 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

E2E8EA313874444C 0C0A229A80C83706 0E54E6C52A73AC90 2BC709A5706D525C 6DE29B3DFA1D455B 734E19B5CA802152 82A60CC00F6DC1D6 1DF4050D5341EC6D 8F389D1A05E7E8B3 04161352E47D9A5B 7BCFA7AE28B32207 36EB7FE47AD51F6C AB7139B2D458E454 A0A9652C02BB4BE0 B88350C05B2C341C FD59EF628536C6DF BE267BF210D5F367 44A0157969B28AE7 E666881E72FA7E8B 842E8E8F9432D248 01FD20BC5A599264 00C434588CBEC000 2FCF9C077355BB2E 3D6E915548ABDABF D002D7C3AEA8B3AA D3C6966E64733441 55C8CF743607FD69 D408261DB9ED3421 6743882CC6192D80 F9C32EB51F4FF01C 7874BB0F63222370 5F039E60642D8BA7 B8FE83F8230A4C59 C973EAE14280AD3A 5D7E0592BB957B5D 405ECE22C1A8A2FD B69E91EB6D9D38D4 D71415C3CA1BAAFD FDEC6E9D4BB131C4 CAA9F620D809C52A 915B3E814020A269 BF3BCCDC3F1CABE2 096C680EAB4EDC10 D31B8358BF85C5E0 8AE25F8AF5729720 711AEF389FC4C809 B0F5BE674BA5FCD1 1D0C827E2F6DFEDF DA6F8C61D3D9CCA9 DABF17FABA392DC2 EE3174071D529AC5 CB900CF4A0904C04 D208BA194D930E52 14AB820344476DE0 FF13D67666ECF0BA E1EEC84C7E407582 B4DE1D6856B97C37 17ED410337BC5288 AFADAF31F96CD33E 80D5E86235727675 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d33264f9-6392-895b-97c2-af87ddd856e4
  2 fed4df19-f673-16b4-a82d-3bc409910771
  3 bb10969c-047d-0840-b7af-d2ec9ecb3d8e
  4 bd49f976-c16c-3474-a24c-102b5dade886
  5 48fb405a-0e48-69fc-99a6-7fba1a9ba1e1
  6 c11e77d8-5530-3f97-9fcc-1b14d724ba09
  7 ead7e08c-a130-0383-ab00-11f5935c6d84
  8 363b31af-367f-5307-8ea9-0b9147f59712
  9 5b71851b-5571-765e-a038-c8dcdf50a5e0
 10 c04b1448-79be-56ed-ac2d-361a1ebd4019
 11 1bb10e5e-de38-1f15-9dab-989b1e2c497d
 12 7b3441f5-ba68-8602-aad5-d8ccc13092ec
 13 1f4604e8-129a-6f88-9615-77b0584ecdfa
 14 61f1246d-5f7b-5160-a005-df639044ef16
 15 dc7a727b-90cb-26b2-901c-0bdd34177b20

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 810363057518652. Exactly this sequence comes out of new Random(969).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 31 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related