201206261140 vn4jd

explained decrypted filler

3DES(name) ECB, 9 GUIDs, seed 440

Metadata

Post ID: vn4jd
Title: 201206261140 → 2012-06-26 11:40 on A858's clock
Posted (UTC): 2012-06-26 18:38:20
Timezone: UTC−7 · title 11:40 against posted 18:38 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(440).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 41 · predicted N = 9 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

B320706D8AE266A5 F855FC0BCDE2D3B0 DA606E8C9E6BC555 9C9F36C755A53E99 510AB1405D6488CB 3B10D1A11A8CC09C F3C7C6F5296AB43A 463BDE78DE4C91DB A7C69A202777DF13 D757771E8ED03378 7742774BFCA2C504 68EF12FD62E49AE7 286C6ECBF04E8BD4 6509D9CE6A8720D1 FEFF34FDCE108CBF B6BB7831F5AFDB52 F35EB37A58634483 F57EFC4A95DFF3CB A06AAD71E9F100CF 6E071E68D19FFA0E 05320938A0DF87E4 0E4BCA2719A212FD A61BB4A5F9BDD775 757053FD66D56880 64F3C3D55B792B55 AEAD54C2133473D4 0C26207A50EB2DFB 1CBED9EF4D552071 1EC5531D752ACAED B541D7D56C0772BA 5236AE3E8C70EE4A 3B93AAF4AF598F9B 7E0BD4693FE0F626 1A56DFDE8D2AFE39 256CBE4F84FC52E1 634AA2BB864B7D14 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ccce5361-8e4c-59ed-8de4-a138fd9f44d7
  2 97d607b7-1041-86ff-88e4-80a081df391e
  3 1400d2ad-d39d-2593-a9fc-4143d2fe038e
  4 bd5e50d4-6361-499c-9eb2-18d7efdf19f2
  5 7dc66cab-03be-765e-9985-4dab87a50556
  6 a20d23fc-4fdd-0771-b8bf-3c4793efff43
  7 bf235ded-56b4-0904-ac22-1d68515685a6
  8 97cd5b1e-0b3e-1d39-8aeb-cd166b03764a
  9 a2986dfb-a225-3a73-9b60-6c8d43116cb7

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 582470013. Exactly this sequence comes out of new Random(440).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 41 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related