201206261243 vn8q7

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 387

Metadata

Post ID: vn8q7
Title: 201206261243 → 2012-06-26 12:43 on A858's clock
Posted (UTC): 2012-06-26 19:41:40
Timezone: UTC−7 · title 12:43 against posted 19:41 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(387).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 76 · predicted N = 12 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

C644E1AACCA41B2C E4ADAC9E5F448C01 C72581B6AB35BB18 74BE0FED65B3B3B3 C926788F54F9A68F A1F424B587C377D0 230FD9697036574C BE8B775E4C29039D 7363DCEEC8E19ACD 66C141F7C11FE206 133A76715E3099C5 3252C5569B891813 E79F4E9BB5949E7F 41846CBA6DF8D579 D8769114EC0A7A55 2AB4DA353F219912 1D12F80186C5E475 DD4ED90906195835 8055300F6EFDBAEF 053845DA7AFF1675 DA9436C01613A335 72D2418A58216A1A 71A93CD66151740B 2D8A61D01D6EE534 29C8C3D659D1A2F8 8DD57303D644A17F 28F197AD50407871 343C721F213CC9DF 229A900A40856A52 A9297C9AD0E1CDDB AE4A7C69DF59C280 23427D2EC9A0A377 F4C526183F98B998 D205EDDEE54D68CF EB1DD30E9DC66DD6 F2AF895A3CFB56F8 02AD29031A8BDFF6 203CED4E9D49E2C1 EE8DCAC113EE2F4D BCA2296AC8CC5568 9419DC990F1B495A FA008E0A47A48976 3D6C19478CEEB603 DAAE12E1BCDF8B5A 91FEAD883359A281 A4FF77C4D746054A A616F666DFC9DA8A D4E741F3886D33A2 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3a5acec2-13b8-8b2f-affe-37852a49d202
  2 6c554e10-2e18-37fb-bfec-eeaa6fa33c1e
  3 c2cc5198-a631-2ad9-ab04-d996fc4ec15c
  4 decbfd3f-2276-19fb-8197-0c6b1e586f9e
  5 499754af-709b-8d48-868b-733d01a7295e
  6 93097a12-f273-6c6c-8366-969d2f2073fd
  7 9dfd29e0-6e8d-245f-8333-f2cd645f5bd5
  8 aee4d6de-122a-597c-842b-1211a602ed82
  9 04abc593-3568-7848-9fac-41385e4e8c95
 10 b88fe7ce-a35e-8426-9d24-47868b766311
 11 f6c265a5-739f-369e-ac31-16113161fbe6
 12 ea57a5bc-e967-58b4-abd0-163d15708316

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 832186257835. Exactly this sequence comes out of new Random(387).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 76 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related