201206261142 vn4pc

explained decrypted filler

3DES(name) ECB, 8 GUIDs, seed 123

Metadata

Post ID: vn4pc
Title: 201206261142 → 2012-06-26 11:42 on A858's clock
Posted (UTC): 2012-06-26 18:40:33
Timezone: UTC−7 · title 11:42 against posted 18:40 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(123).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 63 · predicted N = 8 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

88FA8FE9D2F105BA 7C765BDAA0760A31 525CCD070C9915AC E70DF58B9DC0CBE1 CAD833CF35825DCC 3D67F304AA2B01A8 405CE7875701D083 D5A9493F9A3C3FB6 F5CD91380A8C2635 108D978FDB92E8C7 B9AAD0AE1018F972 7C29E35EB6E23BCA 9E4F06329645B32B 6758794E6E03F397 6FDDA98B1BE74988 171ECEAF45C988FA C8B0474D40BCB018 680D24A8A69B7E73 C8B3B08690680B45 8244118B77CBDB2E B091B2C1C20B264B 831393E6AF817A65 B446C32DEBA66DEA 5C67B5CBF44D9760 1928D4BBAAD9BD99 F3D27D555A474EEB 3571AC5D73AF1824 1023428062C20022 D551A65F592774A0 706A89D991B9CC2A 78BF4A848302449F 37E324896BD490BE 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8928b849-89ef-81fa-829d-f287e71ab4a1
  2 c6e80491-85db-8780-afb5-eb1144aa557d
  3 7e67bde2-3c69-6ae7-8bda-f253205192e1
  4 45740144-5eff-7561-9304-94602b592b3d
  5 3eb146e1-7358-69c8-a36e-e8a46b5a8cd5
  6 c93d265b-d8e6-0854-b403-f7ba4bb4a26d
  7 321e503a-0b0c-0d4a-8d90-40eb4f09d378
  8 40764eaf-f1f8-1396-880c-27dd8be97f6b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 88676001. Exactly this sequence comes out of new Random(123).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 63 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related