201206261140 vn4jk

explained decrypted filler

3DES(name) ECB, 11 GUIDs, seed 384

Metadata

Post ID: vn4jk
Title: 201206261140 → 2012-06-26 11:40 on A858's clock
Posted (UTC): 2012-06-26 18:38:26
Timezone: UTC−7 · title 11:40 against posted 18:38 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(384).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 42 · predicted N = 11 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

7E5B4C6EA45F33A0 BE2C224B80D3458F 66EC3212D771F77D AA08587452859DD2 BEEA514356DC4414 32A216E92D37BBEF FAB9FE9013AB1ED0 5D1E9B0B3DABA280 366E24083A604241 97960FD54FB02AF5 4CD887EBDAE3D0C4 427CD618F8FED9AE FB6353891142963F 6E93D3F6F4A023DB 36B78D99796B480A C0B52C186C7FAD1A 8B58D7375526E15D A2B74CD61B2A73AF DD4E3E0417D69BDB 8DF74238D948222C 108A2B5CF1C3B57E 3EB1B61E4A4E1471 CAD43E5E40153D8C 2475E1DD78A19DDE 489A780B9338102E AD630C2A603621E6 1781E353CE3AE8E8 5332EB2099124DB6 DB37B22E8120B8AA 231EA52F5172B29F 45A5C14BFEEB2B86 4DD8663F8857F4B5 A8F73396E0CE70F0 7FA583D55E70B3D5 3FA1707ED0541B87 C666DCB08C9137F5 262DEB9314203A4C 0DEA0472273C0139 DE9B9128AE5C5F1F 4AE35B562E849E49 ED2F1FB24163F841 B1A75ECB052A93A5 92AC3F1D4D25CDC3 B70E6026E4A81252 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fb90d176-645d-355a-8c4b-c7946a5ede83
  2 2480b2ee-5dfb-409a-9379-624cc0d15318
  3 abbaccf5-8868-18cd-8117-55c6f27341b1
  4 d5095efb-ac7b-411e-9cb6-18d808d0852a
  5 9c43216d-6628-5610-a69f-021744f58ef3
  6 166b191c-d252-1911-ae92-3758329b9f8d
  7 aaf3a3ca-a292-84c8-bd09-59ddb97f1892
  8 b83ec124-c88f-09eb-b45c-eb0b6869de17
  9 c5642296-023c-4d54-9487-e8e4b6a97f1d
 10 ddf4efdb-b4fd-7bd3-966f-cd9221d066af
 11 6ed7bca3-67bf-1e4e-90c8-9cb2efc9f1e7

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 34145180471. Exactly this sequence comes out of new Random(384).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 42 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related