201206261140 vn4l9

explained decrypted filler

3DES(name) ECB, 9 GUIDs, seed 369

Metadata

Post ID: vn4l9
Title: 201206261140 → 2012-06-26 11:40 on A858's clock
Posted (UTC): 2012-06-26 18:39:15
Timezone: UTC−7 · title 11:40 against posted 18:39 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(369).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 50 · predicted N = 9 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

45A192360F451371 D1E1FE334F4B3A7A 8D39D8DF4A02F90F 8720883D8F9FF0B0 B607429610D5DA4F DA63E927FB26DE0B 9D5DB649F0F37E94 482FE885C86727B9 A0A8295385AD7771 B4C63BD555AA1438 A3B03C48F59F8A5D 47B2847472CCD841 B9A7E3B73E0DBA56 3C51337E699C15E8 7A1264878B868EC2 1F78BA7C75CF7104 2F4624FA0ECB3B50 FAA3B3B6EDDE70F9 2698F2DDDE889896 73AD5D608FC263D8 349E0B773D1DD124 F0F0DB1ED0E0AB63 91BE99A1D5CD1671 106A3B134BA93571 0A2A194AEAE3B7A5 E03DDB604FA1F731 EB344F7892C2502E C3AA4F900927D320 E5D1C769F020EBAC 90932872BEDB10F3 E6EBBEFBC7614984 0FCA9A28C397A5EE 41DD2A4C4C6FA814 A696CED98C70D4F1 AE57EB1666B30BC2 CF6BB27D270046A6 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8658c11b-62f6-4fe1-b622-eb5c3933f71a
  2 8b32e442-ee0e-0cf5-a3bc-8a2fb98a0b86
  3 655c2f18-07cc-6ecb-a179-502bccb906bf
  4 4337b8e9-c8db-2592-8490-b9fcf176edb4
  5 a4bc2fdc-8f32-7d1f-afae-a7c0416130d9
  6 330314d0-66b4-0e93-85f6-834bd197a863
  7 eda1a7d2-d256-2d7d-8b1a-cdbb33aa4269
  8 0739ec47-a086-56cf-a0e5-8579dd163e0c
  9 6fed643e-dbdd-5751-bb03-33f5b7fa9926

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 406270255. Exactly this sequence comes out of new Random(369).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 50 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related