201206261142 vn4os

explained decrypted filler

3DES(name) ECB, 8 GUIDs, seed 3

Metadata

Post ID: vn4os
Title: 201206261142 → 2012-06-26 11:42 on A858's clock
Posted (UTC): 2012-06-26 18:40:21
Timezone: UTC−7 · title 11:42 against posted 18:40 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(3).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 61 · predicted N = 8 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

5F10230411535C09 1F77CDF3B0518819 97F79C59A3555A78 590C82285A4BE034 DECEC8F64413E025 F70DDD88F2C6F361 DC0997EF495E72CE 687D6A3B247232E1 D07E5870FE00F2C6 CD319109A0AF0B3F 987AAFA8A8169336 CA291455AE9DF89A E2D7410D75A44115 BEA09ACA1D705EE9 534649E220D2CE51 0881B737863BEB81 08CD54918DA58FCA C5ACA0BF17E1A03C E5C03F5EE47F8D30 8A94279BBECF9928 6354ABEA8E71B38B 38A26423544ED293 CC3976C943FD0003 7CDF59CAEEECF3EF D706AFF59CCD9134 D4B6A1B2B2E94B0C 81B78CE0BCE282A1 D17F87178872B98B 2108379AF206B4DB 5739554B4C8B80A5 34848D1C02E624D2 6AB16093D43ED436 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f4d6219a-4b60-24eb-a188-70589ce68c7f
  2 764683a0-f161-6a01-86ef-390ecc4f05a9
  3 2f8d42b7-f6c0-78da-acba-02981ab5afb2
  4 aa1c781d-b10c-1dc8-91a2-b0ecb0b70684
  5 35eef6b5-a33c-5ada-a5ee-a25f1e9083a9
  6 711732eb-4ed1-1c6a-8878-694c5997738a
  7 511c1df4-21b0-2faf-a151-24a468a383a9
  8 305c4053-a9fa-8f73-9de2-485f1907cff1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 26715128. Exactly this sequence comes out of new Random(3).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 61 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related