201206261141 vn4m1

explained decrypted filler

3DES(name) ECB, 9 GUIDs, seed 618

Metadata

Post ID: vn4m1
Title: 201206261141 → 2012-06-26 11:41 on A858's clock
Posted (UTC): 2012-06-26 18:39:27
Timezone: UTC−7 · title 11:41 against posted 18:39 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(618).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 52 · predicted N = 9 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

417E0E96F22AA299 8C27FB10EA408CD5 3AA6A324D518B7D2 EF79D9AE9C063392 645D915B3DBA1029 3D26C477AAE5B7CC 12E8947DF009E45C 27DED8391E980FF0 9D38F5F1FAD3A65B ABDA13A9C2E7B333 FFBF7356D4D6EC7B F228F062E124DD23 BF08A2702D2531FC 80FCF8A434556147 F666F40B13C53196 D88561DDE8884E7B 275A77F1F01677D7 7AEE7517DAC4A3EF BC3C3A721797490D 2E436D1A0A7DBA86 A1FEF603FD93716B B6F8CB21D12837AE B6B99A6995F8DD68 69251CFE5BB71BCA 926A1AB6F8D29605 C226E8B2D8F4E795 60E40CCE84A7486D DF9A74FBF7696265 AEE05AE621DFE769 7893F08EE809F180 C696CC1F2110AA2A 16100959EC0C956F 0F61C16A5A41D7DF B7280EC3F1E89C16 B1C2F28FD8F47D64 38B9DD47142E5610 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b2c54cdb-101d-536f-bab7-1a66af145e8e
  2 9de55ded-f0d0-1170-aca2-135474392065
  3 181db1a7-01e0-6e53-8967-9a7ce6329fa8
  4 2cae64c6-2c54-41a4-a214-293127a258dc
  5 636c9248-b836-2977-8a6f-9157b65b6880
  6 619fcb26-1f6d-5ac1-9495-ed282c255099
  7 975ec0a3-d604-7ede-b7d8-006803390fe6
  8 696138d8-9a19-462c-b426-ee40950541c2
  9 8b4fd59a-283d-33cb-8b52-0ff1afc4ffbf

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 516425743. Exactly this sequence comes out of new Random(618).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 52 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related