201206261140 vn4l1

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 395

Metadata

Post ID: vn4l1
Title: 201206261140 → 2012-06-26 11:40 on A858's clock
Posted (UTC): 2012-06-26 18:39:09
Timezone: UTC−7 · title 11:40 against posted 18:39 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(395).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 49 · predicted N = 12 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

9C13BE9276B8D21D 7AEB74BB93DA9223 B1DE076787292CEE F2A5D008200F8237 D8978A385CDE793E 0AD6B91880C26853 C87D143F238AE7DA B0864FFE1EFF5647 7D996EAC5F399AFF D09026F22C9399AE 30E40BE7158CEE98 A7B2FF15B21F22C9 62971CE2130FA96F 17D035D04D5E20C9 D8FC7C0CFE9641F2 E2B1DD3AF76DF63A 57613F2CAF75115E 5AC6FDD25BF627FE 4D095036BEF6BC22 4E5E35F974C4C14D D891A8E46D22CDBD 39C86D5ED5DF7A71 D9147DE383CF8935 483BDA8B369EEA3D 0C591D7C9DE8F214 337CAFD53962369D 04DDCB09F6708455 86009D90960D960C EEFE9E5A311FF606 6497375A9BB71BFF 5E9BA6010B1621B0 B31178E7A36DB9D3 86C87001F3282E09 D110080631FB755A 8183875A3DEACE1D E039D6FA4EE3090A E98ECE6394397689 492645DC55CEB955 90A22C55B435004E 5723D56AC5DB32E9 B78ADF2225D56B12 E844C3154BAFA414 B33A41483C1EC978 8BF62CDF3A297A06 DC8F061FDCF80C63 95FC5904DE92BF0C A47827D572D686B9 FF5F26F30502AE2C 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 315b4830-873f-0f3f-a7a5-2ff166cc10cd
  2 1014cbbd-fd48-6561-843c-5528cf4aa37e
  3 488ef9cb-9e3c-77c0-b294-134ff3f83c70
  4 fe860057-4dfc-7210-8f14-20163fe4f5dc
  5 1381b58a-437f-47a9-aa9a-a816b6e576db
  6 e72c945f-2234-6a0d-a9e1-e1aa18ad00e2
  7 8ff55bc3-092f-72e4-85a5-11aa7eb551f0
  8 bd30f488-6f8c-509a-9dd5-5e5bdb9fabfb
  9 2a590e3a-e2a0-738c-8a3d-6f6201e20341
 10 c15f9558-915d-82f2-91c4-f99f1db3f662
 11 d0fc9d9d-d049-2f44-9bf2-d8438e67a91a
 12 96d78ec5-025b-7a7e-a356-a1fca84e44f9

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 067746757827. Exactly this sequence comes out of new Random(395).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 49 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related