201206261140 vn4kp

explained decrypted filler

3DES(name) ECB, 8 GUIDs, seed 492

Metadata

Post ID: vn4kp
Title: 201206261140 → 2012-06-26 11:40 on A858's clock
Posted (UTC): 2012-06-26 18:38:57
Timezone: UTC−7 · title 11:40 against posted 18:38 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(492).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 47 · predicted N = 8 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

888EEA766CEB590C 13CF1FFEC434DC4E DC38B0EB96DA1593 6923B8951D0C6ADB 9149AD6B037B3E98 7FBE6F4787555703 7619326A86FD38FE 341A230C9F7F5B2D 655603AF682007FB 48EFAFD8915632BD 6F23757F53EB5D43 FA611096218D8E5B A805364628523017 E718DF7C8F9E999C 5E90D038F2DAD507 E630126159958DD4 C6F0846379D6EDF3 A17507A2C89FAA6B 3A729CC3B0DD8996 370C96A474563F39 02076D667EE0888F 2CD54634E799EA0B E8487172829A9951 B3764947AB7CF54F A1794D4586F1B6DC 65C8404F2BA2F559 A41DF8001622D422 8662FE9ADB0C2BD1 3FC6EE2FE31783C3 2F19C93D7A7C13CD 6699E234A365F78D F0F71F10F2D90A75 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fe7ca310-657c-656e-9845-57e580d6a4fa
  2 4c82070a-19c6-1a14-9bce-286c78edcd1c
  3 4109fc97-bb36-6124-b83f-cd393ff1052a
  4 3ddd68ad-7461-55c2-803b-3c27deeb23fb
  5 39bdea35-8789-3227-a062-18ba0fe3545a
  6 4f53bc77-8b18-4395-be34-d691a0bf489c
  7 e9db63af-4cdf-3f27-9d99-8d10913defdf
  8 418937a0-f294-2568-ad68-34aeb3e82e57

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 61653432. Exactly this sequence comes out of new Random(492).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 47 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related