201206261218 vn73c

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 956

Metadata

Post ID: vn73c
Title: 201206261218 → 2012-06-26 12:18 on A858's clock
Posted (UTC): 2012-06-26 19:16:29
Timezone: UTC−7 · title 12:18 against posted 19:16 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(956).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 71 · predicted N = 14 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

542DC5765C0AA432 718E4492902F3770 F2874361A87BC6F1 645D3977AEF6534F 4854E55D420754A2 7214403CEE27A7EB 4B39B09BEC62035C C45DC2A3764B7E75 E1E8C6C54D056A23 EE6DD92592D605CD 40DE770AFFD6323D F9571C1BA1867E1C C117F3720055B7D6 1175998D743D0093 B73E09882D05A5D7 D51D8606DD1F4026 59E9BA2FA26C2140 7D1F6764544BDF41 5A4256DF26944DC6 9EA6CF64D8277286 41AE49799D4CF05C 1812DF5F55D10E08 4B1BD73FE0F016CD 2FD37921DCB292D6 6184DF5FFC705FA1 599FFD1B2192A18D 097FE131947D6908 6A122665641D2715 F1FD5BA6E7B2FE9B E031594F4E8A737D 81EA7D65F1664228 7E3679B8231D324E CBE0AB99062643D5 23464AF67ED5BF32 9BCE68F6BF4309DD 101C5DDCD8379BBD 7519297074F1AB15 E4F5477A2AC43223 E8900B1557B9212A 09E19FB170D3BEF8 B32248F89737B65C 788C5EEE100AFBA5 EC1D0F4657AE80D7 62E5566C7A3067FB 7DAFC924E9A52206 010F3A3023EABF65 DA44CCA90BF1E037 50BF23D861E3391C 6136ACDD4889E9C9 4758AA25C0107D87 3B00B0EDAA69074A 340C69FF4F93495E A196CFDB35CC317B 210538836E38B387 EFE7CA5A583097D2 D99F5A874AAE6DD8 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c56d8ad0-107f-18a8-9982-61b7576bbeb3
  2 da455125-6691-298f-b684-7b96c73b5933
  3 77ea6fa0-d40d-0730-8be8-bbcfd5c2bd34
  4 e7bd1002-85bd-55ac-b656-e4fbd1c2bd01
  5 a3d11e16-b93d-7365-b457-7c9221bbd215
  6 6504c065-1bae-09dc-b6ea-469dbd8dd023
  7 d235c511-aef5-2c1d-829e-da4343bf7817
  8 6498c8f4-6c9d-0c0a-82ec-1cf2709d877e
  9 915e3412-292f-231e-87e7-75fd10a1e2a8
 10 63d6bdde-b64a-731d-986c-3e78aecc808b
 11 5b4e5f56-4f19-579d-9c8f-e089871ae621
 12 a7a7deca-edde-7854-b375-aa8ea71fda2d
 13 2b8a0fa2-d9bc-7e4a-b761-c44ea614f04b
 14 fa6f021d-51a0-73f7-9466-16c471b682fd

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 12057020275777. Exactly this sequence comes out of new Random(956).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 71 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related