201206261140 vn4jt

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 327

Metadata

Post ID: vn4jt
Title: 201206261140 → 2012-06-26 11:40 on A858's clock
Posted (UTC): 2012-06-26 18:38:32
Timezone: UTC−7 · title 11:40 against posted 18:38 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(327).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 43 · predicted N = 10 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

8FF53D64BC196A18 DD676B7EF677E486 E8BD5FE5A5BCAD84 84894EAE9BB7930B 20487DAE54FAD01C 4D4E54FB5AF3FDFE 8D1AE415C669C4B7 25410293E6CC8188 A52BD02093BC3999 0441492B15F6051F 6F588036BC147A6E A548CCD282751BF3 CC75D99A6CD6C8C5 057A507166E3D1CF EE2DA036903A9CB5 57FC73E0D5EBFCD1 F61FF38A7F387DF3 948E6CE8F1590E7E A6ED060755D4FC63 0AFF58C8A54E50D8 45C518C1C2734A51 30128316C60E6CCD FA5D68168C78FD72 15F7077095A5FE60 5EC672C0DA2A4229 EF686967DD95BABA E48A82BC4CC3AAF7 C923467EA601FE00 BA91DC03A45A786C 36073831F1B29A37 67B3857E886CD6A8 0DE376CFA0A8DAFE 3321FA82385A21B8 95BC09066AE2A9C7 B5BF805F331CD812 6AD0EBBA620504EC FF74C319FAA78CD7 B324B51BF8D2316F 446ADD311A72ACF2 6C3F1B64E91F1280 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2c560898-ebf3-5cfa-bd94-e9519ec45fbd
  2 7bd51fcc-9c1d-689d-a5af-1e7efd8092c6
  3 7f19d718-b01d-331c-89c4-138bfd2f9436
  4 ab78dd50-7c9c-37cd-9045-7f21db9549e3
  5 f5079444-c7d4-754f-9c34-e6302b303bc7
  6 4c7e910d-9b7e-2a3b-823a-b708ef55c6c2
  7 ef2c36b1-6b5e-32b4-9b2a-939a158c160c
  8 d665f268-1fdf-471d-bd53-4428387dd1f3
  9 9462316b-2b3e-355e-aa9a-70d29ac71f3b
 10 f5c7ce7b-80ae-78c9-907f-597eb057559d

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5633723437. Exactly this sequence comes out of new Random(327).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 43 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related