201206261223 vn7er

explained decrypted filler

3DES(name) ECB, 8 GUIDs, seed 204

Metadata

Post ID: vn7er
Title: 201206261223 → 2012-06-26 12:23 on A858's clock
Posted (UTC): 2012-06-26 19:21:31
Timezone: UTC−7 · title 12:23 against posted 19:21 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(204).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 72 · predicted N = 8 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

ECC31D125EB3D1C9 6368BC286CC4D5E3 726D8D9E58B74637 493FCEF9B0D82B69 15A6BBE67F87DF68 78113C7B78C2CD64 21AA083251E1BF44 ECD80CB3BC1E525E C2C5CFCC217EBA44 4D7FB2D99F7F586B 0142F9BAAF875980 9DF8295C09678973 E5CAFED764AEEF9E CC7B94A8664C32A7 612690DA4EACDEB2 99EE66C8C1E30304 ABFAB6220E781E08 34CA2AEDCD13E5D8 52C8E74C00F2CA1C 6998E54EAABD9698 A21BFF4E32697DDA E1EFB63A2D7D664C 84FEAEF8F195E6F6 717C3AEBA9B5A169 A46E2D69F0F1E309 F14D40B5483D33FE DC8DE7FE54FBFEE9 8F6F4F8727F70F3F C295F23342E3F7A1 E015088D814548B5 85E25374BD59CD45 957294112F667449 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 273843d2-44cd-291e-a7e7-f52d090a5db4
  2 24a1c397-5331-6a2f-8b33-fd13bbf045c5
  3 f92fa6ca-fe21-33c1-ae60-1ba451622026
  4 16e46320-8d8a-0ec7-a7dc-6903ad478250
  5 ea1c46f3-fd36-2452-9bdc-74f5f11a5a06
  6 9d7581cb-cee3-71fb-813a-3e4772d29405
  7 7033a60d-8d46-2eaf-bd7c-7060c67f5e07
  8 a530e5dc-d5cc-71ff-817b-718c60e8c457

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 26302727. Exactly this sequence comes out of new Random(204).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 72 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related