201206261141 vn4lq

explained decrypted filler

3DES(name) ECB, 15 GUIDs, seed 350

Metadata

Post ID: vn4lq
Title: 201206261141 → 2012-06-26 11:41 on A858's clock
Posted (UTC): 2012-06-26 18:39:21
Timezone: UTC−7 · title 11:41 against posted 18:39 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(350).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 51 · predicted N = 15 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

2DD1A73C7836B8CD EE912ACB0F0F8A9E 622CD6A8EE57D9E5 225871DC18F021B1 EE8EE4FA02E2215F 292668F6A238DB9C AD04CDB12312A6D4 FFC7A9580AE08065 31C9AEE3BF0DBB2F 87A6ECCB187FDF14 71FB8924F93CF288 4982BF919873F99F A49F355BC8D92607 115195114BD0AE99 C07CF745B5BC0D91 08857518C5E72D6D E1C62902F9FDCEC5 E98A35C68C34F1A6 717ED74C64574ABE 78322EAD4326E31F 23ECC0BE05EDE417 30410888BDA37198 6BB8FC505A03C85C D9D01E32C0A482B3 5B58718F7B3CFE3A DC396A523B02F3A6 7DF9834B2B16059B BFD27521B8634616 F4130F2BECD406DF 3AF39DABF0BF35E3 B56D85C4B0938620 4CD6934C22B6EEB1 E019BD0C41C3263D 81EEBC5BE3FD5236 3DBFEAD0E3C2D6E7 6909806D99D018E9 D5AD37CE1BED19AC 674711541887C184 6AE2B7E82482DEAE 0AFDEB2F97C36E6B A632E9AB9767E839 1D918E5D3601CBC5 876B620EB1794AA8 4B110C8C19109A26 1AA39912F568AA43 350DB215134A18B6 58441519E289225B 9565D2D6C0E1014E 54D6CEBB41FF2347 E9CFE990A4A93857 BF00C3457BBB9876 846C4C2C8AE78F5C 314902BAB883B842 F8FBDF054E4B8E4E 91674EC6754F31F6 D22E451D0265996B 05F0D7BF041761DB BE21C519707242B1 E074C8D1145C61F2 DBF03E413D349EA0 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d5d62beb-0fd5-5d0c-9369-535b367a29ef
  2 79bd8980-c797-4a42-807a-fe2e039db4d9
  3 37fa2acf-edc5-3747-8c8e-5b2afbd39165
  4 6a73de72-7c81-230a-aff7-bc6f7da4602d
  5 ada841a4-69f8-2f39-b245-c47e8d4133f1
  6 b0fbe195-104d-35b0-a3f8-e3b4f84e51e0
  7 27f866aa-c815-6c33-b671-aadbcfca9bd1
  8 73a4e73d-cc11-0559-afc6-ddcc5cbc6b27
  9 8499f20e-f1bc-2b07-bdb2-6ac5e2d9f63d
 10 f0c8d52d-17a2-338c-b782-4d29b2733efa
 11 bf81fcb8-33af-150e-831f-1f3b4ff0e358
 12 9a60ca9e-0f66-6deb-8af6-5ce166af8488
 13 986bab5d-05ee-294c-962f-50dc403fb492
 14 68c43d6c-28db-5145-a50b-6e0e6812848e
 15 2018be5c-c0b6-8c6a-a021-2126344a466d

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 543223602316258. Exactly this sequence comes out of new Random(350).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 51 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related