201206261141 vn4mv

explained decrypted filler

3DES(name) ECB, 13 GUIDs, seed 734

Metadata

Post ID: vn4mv
Title: 201206261141 → 2012-06-26 11:41 on A858's clock
Posted (UTC): 2012-06-26 18:39:45
Timezone: UTC−7 · title 11:41 against posted 18:39 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(734).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 55 · predicted N = 13 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

571095EAC7C1AECA 9F3FFB766A2C30D6 41274C867BBB2881 675C7A654F0CE520 F7F2573B9FF449CD 76FCCE3E20B220FB 0AD49D84E317ED52 958DBE8D17D20C97 3E7646D2BB7EB081 3CC8D5D86BCD35F8 BBE1497C92035417 6D265AFE4D406F58 033DA25AC9C2B55B 4237E4031809D2B9 4C005931D6571183 FDB3E1CF9282E4DE D17B27029E4E4378 C7D13EBAF7DBB33F EE6EA4E3F04C3F10 9BF3B930C4369C7F 53B135B083B28DEA D8F60B6FBAC6AE73 06C0F0067EFABCE4 FFF53CAC29800953 EABCB3CEFD56C1F4 E6FD23B739F55196 D0805333F11D89AA 713A64BF6570C22F C803DAF443A78BE2 342D906055B4193A D01E2EE842F75E6D 4D35843FA207755A C3185EA14C386E6C A52D8625E864A9D2 510790AA5A5AAC91 473D2E6794DE6D89 D35BD5446C212620 E146BCAB8506C2DC D4F37E6568E5D432 C650242B54CFA60A A523726A6507AF50 C27113A535AD69E0 4686584097BC74F1 C4E1028FD2BCDAF7 F5C4D50E26938D3E 6A705BF75FE21BD9 DD3F8B7755030D3D 1FD6D1F111457DD2 5FB57EC6EAC04628 1470E8F74A35CA3B 3C4973F04052F69D 0CCD1CEEB79E995F 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 de833921-bb1e-16dd-9e16-411b8aa873ac
  2 1caabf4b-e797-1e38-8bfc-c9de1a8856a0
  3 4e22c49e-81f1-7ca4-8b9f-08894ddf196b
  4 f9682f77-c760-2737-a747-c43e89f47b79
  5 98d5e2a4-7bf8-5053-bf41-f4d521d4eb8d
  6 180c086f-b4a0-873b-8446-11ef3c079dd2
  7 4950e22f-06e4-7173-ba92-12ac510070fc
  8 cc86b327-29dc-6755-8ebe-c9f1abeefcff
  9 4ffba3ee-a6ba-753c-a119-0aed269b5749
 10 b4d341f6-1bbf-8ffa-86b8-15ce7232977d
 11 531d7d2e-6e03-0e1e-986d-d05db736ab0c
 12 c4286766-684e-479e-b71a-af2871091a7c
 13 dcc016bf-819c-188a-9b66-b18bbd88c879

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1172587678041. Exactly this sequence comes out of new Random(734).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 55 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related