201206261139 vn4ip

explained decrypted filler

3DES(name) ECB, 13 GUIDs, seed 905

Metadata

Post ID: vn4ip
Title: 201206261139 → 2012-06-26 11:39 on A858's clock
Posted (UTC): 2012-06-26 18:38:02
Timezone: UTC−7 · title 11:39 against posted 18:38 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(905).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 39 · predicted N = 13 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

A94240231E5B84C9 73FBC364372A9656 329F97EEAAD367E3 80B9EB87540C4357 E4248A74D3B573D3 DB6C503683CCF61D 849DFD6A9AA05B08 F6BC532A3C78AC3D A4CF2E98ED66C85F 3E0A5AB44993C2ED 33DC362891DC19B7 2F40C5B636D6AEFA 40E2A0984CB6BB14 17D999C21710C467 BD0600D0367A0181 F67FB0A6C2EE08FE D1DD14668E9CC58D 50B61059387AED17 F0D5C395044EA5FA B8E5D1C56BF9D148 E651393612375350 8CB449951FEAB12C D59C642F517ACC00 4C4A333F3AD63851 E8FD22905DC89121 0CD29F55857B20BF 4001977343A5F22C 1F655E25E0525280 190034BA455A6B33 7282DAA566B6C385 3759E9004B527383 17EC390D147BB810 3010EC750FFA1B58 BD1BBCBE63880044 D3DF04203DCBBBB1 48B558AAA4FDF933 73FBAA92578EF859 14D7EBC5F2EF6F6F E84A6027319CD90B B332C962ED1D520D B421E952E79588B8 1BA3881885D4814C D892FE771493AC47 83EDF0C2DC47B857 EC18AE9414A3028D B95DE6853C408407 65E41C86F59A49A9 DD6FD1A8ACC95482 D3668CD13EBE2DFA E220D24B609AE17C 46B519DD2F6FD160 896599FBCF634F5B 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ba6eb646-dc33-47ba-8dd5-a46010cd978b
  2 a08a3da7-9e9d-3f81-922a-7263760dd815
  3 f39473b6-bc4d-3077-9544-1d8c30fa8aff
  4 5d3d2d90-e8d4-6d13-8318-a487d8319ab8
  5 71d1cfcf-d15a-735b-b11f-cd31a07eded4
  6 5b003445-2f7f-335a-bd73-bd7694167ca9
  7 a0b271e4-f76e-3583-a125-5bdf6ae51927
  8 c13db187-1384-461b-a3f7-780cfb588d25
  9 6a9190bd-089f-8680-aabc-0d7b368ca5be
 10 01bf64d7-a5b1-8448-bc5e-daeaf2b80ffa
 11 2dc73a84-55ef-03aa-ae2d-61a28325b9d4
 12 af1f3780-fe9e-032b-b4da-e04324c7ca56
 13 e8d1326e-a98c-6de1-9a44-3482cb019acb

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4336733488006. Exactly this sequence comes out of new Random(905).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 39 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related