201206261139 vn4ih

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 681

Metadata

Post ID: vn4ih
Title: 201206261139 → 2012-06-26 11:39 on A858's clock
Posted (UTC): 2012-06-26 18:37:56
Timezone: UTC−7 · title 11:39 against posted 18:37 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(681).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 38 · predicted N = 14 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

4FAF71D93B871CAC 23DB626711DFA94D 64F718CED3547D09 B1640D574791FD01 1A082B2B4B38B86E C6EC3A61D1E205CD BE764D3A1AB45B84 A078133A69CC9DD8 E3C0EAF139A4DDFE F3451A9E19EC56D9 FACBBA2C106D9692 DE1C1BEB2A60487A 75EB71F9EE2575EE 7A923887949E363C AD2FA3523966650A 1FC60D3067BE868A A71D891EDB4E46D7 428A2D60773AC0E1 FF03151359163F34 34DE760E929564CD 476139266BEFFC6B 0D47A8EB3A8C098A EB95A1644835D377 E3F1FB7839B0955C 665C97214E128418 7D834B71374E2E30 73346916DD0D2A9A E53528E0FCE20C90 2C72F4517F11E0C3 6F2834EFEE887ACD DA4D9D9BA1DEA892 F5C5C03E04549615 4311E8A507FEC93D 17D5173E5A6D5E1A CE97F4B02F83CD74 A9EF41C7899A3BD0 80CB31825813763F 47AA1F5F9D2E54EF CB5D8658E9668D93 3D16609E0C8D9194 C619E3DBE9861309 A5B82E9028E17E0B 75EE632AC2EE4F04 B02F1C8615F6AABA 42C78B7A5FE308CB 1B124261B5AFBCB2 8DCB79CC2A38B82C 8C7F75DAD5090362 0535F7D4D03E355B 36433668DCA59C5B 23271883DAE5F78F 962CD9E29715AB92 0A1BAB599BEB9C0A F466BD8CDFD455CF C605E9DC81A3D8DF 87D09F8F2B7506A6 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 12536463-dbdf-4aa8-8167-1d4496c6b368
  2 7c3f5372-f74b-50ab-8cab-f21dad35ac0b
  3 b5e9bedc-6e46-7348-958e-1e3da4d3efbb
  4 075c1ae3-b01c-88a0-9dac-61d3daea65de
  5 ccee04ba-6f24-6bbe-93c1-7a175bb4849d
  6 83975093-ae44-6349-9dad-7e86d2c0a4c0
  7 43819b9c-ff73-0b4c-9407-bd571b184d2c
  8 16eb1220-06c1-0b88-ac4a-8dd22ad2a373
  9 b0ddfcca-d432-2408-8301-dc944b13eea5
 10 61a6b67c-36df-3e42-8dbf-200991797416
 11 5669148c-6c30-0a49-9d39-a06a4cc0aeb4
 12 f2a4fdd9-9941-1633-9360-8b2c861c6d0a
 13 33e7d416-e10b-71fe-a29a-31d953cee3e0
 14 3ed736bf-11bf-68c3-b049-36c301a71940

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 45786600230176. Exactly this sequence comes out of new Random(681).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 38 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related