201206261142 vn4p0

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 164

Metadata

Post ID: vn4p0
Title: 201206261142 → 2012-06-26 11:42 on A858's clock
Posted (UTC): 2012-06-26 18:40:27
Timezone: UTC−7 · title 11:42 against posted 18:40 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(164).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 62 · predicted N = 10 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

6737405F38A27BC0 EB2A481C94BB5FD3 7DB8021541143695 CA8516AEECB84348 2F0A2F425F38D4FF 5C397A6618740B7A B749BDE6E58E5910 49311640A3BC881E 0EC698C5BE7E74D9 D265871FC926D7E4 2B1CEBF9242C1B31 CEC9592C2DE327C5 1E62B03F2D1D9187 125A32E38DBBC6B2 FD422C8A72F7DF3F 690F790EE71693CB 77C91B53C1CADD3A 0BA820A87303B796 B9BED43C6BFA1295 0799E8FB735BAF66 9E2A9DAED3006517 E0EB094C579A9184 FF16BC76833DBF0C ECFED073F3948BF8 BB545F9B807BE72F 0EECBD4A89E30987 5905AC928611D4BF 68AD13D84B0075EC F6F6BDF79FB5683C 2D9806E537C34A8D B63443103122EBF3 CF7BADC3DEC0EC0F C664C39F6F138E0F 0A3318038BF20F33 BC729456A5BEA72E 01150965DD445AD7 7B47D080CEA17BEC 6C70764989A313CA 8C770D383E569D46 94326E61B034A778 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 622075e1-6b44-38e0-a33a-ead0297ae609
  2 9d7eff13-1820-8e97-b554-87589d5ee4c3
  3 65b2a612-1591-3aa6-b0c1-54e4d9ec1e64
  4 a045cee2-45e2-5b71-b6b9-3912b5e4a468
  5 a77eee67-a3cb-255d-8e3c-809f321e2d3c
  6 f4cbf9e5-f5d7-76ef-8d9e-979bd391a04c
  7 b269bf03-7ac0-3735-a993-4ca3676e7b7b
  8 4952d648-b383-655c-9b96-a92ac81d5124
  9 719a47bf-6d0f-29c9-9465-0e036807b81e
 10 b6117e7e-1e60-627a-8cf2-7b3adda1abed

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3835273626. Exactly this sequence comes out of new Random(164).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 62 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related