201206261248 vn92j

explained decrypted filler

3DES(name) ECB, 11 GUIDs, seed 228

Metadata

Post ID: vn92j
Title: 201206261248 → 2012-06-26 12:48 on A858's clock
Posted (UTC): 2012-06-26 19:47:01
Timezone: UTC−7 · title 12:48 against posted 19:47 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(228).Next(9) ✓ verified
Run: Run 4 (seed 664,106,302) (seed)
Draw: 0 · predicted N = 11 ✓
Machine boot: F 2012-05-15 19:07–19:12 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

9A5EF693CAB540B1 BE4470889B84A44D 9164C162698FDF56 3E628662E4D8F8D0 4DA85EA23D390C24 3B38D15DEDD405D3 125373C300FDC5D3 5D4A7D6766C91752 F76743B8B5DA2872 B60C7F68AB71DA8F CDE7EB9B25B041E9 F88A6DF4C51921C8 84629608A555B566 53E99E5A09432B99 DD51518FA53225F0 5C7488F76D34291F 20AE7DA495E89BF6 35D1C400CDB9629E F1C6AF3263446617 338723A65AEF9DBA C23057E1F1E7C6E2 B30943B850F37C6C CE9C959884C6A396 2BD6DC6B4AFA849D 9301A321367D83A2 122966B41368AF74 655A41CBF8D3AC0D C59A9A645B2C65D0 65E4862540171CD4 20669211A4352F1A AD644F259F097D3F 2A7BB8D7E9A9E86D D5FDAB819C970683 30910BF850DFB22B 9D4B0CA17A41E7E9 17E52EF10C384AF6 D90CB2EA2D8AAE7A 7C958565BD9C3763 85A93FBF25C305FB 23F0C85B2E5CB057 BE0552E4AF29F7BA 8E2C2B7BDB256544 D0692D83E2C81D5B 11C3DCB38A23039C 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a321dbbd-2e8b-76da-8501-c4044282ce75
  2 8a022ab7-3bf5-676b-ab03-04dad6086d5b
  3 9e0560d9-51e3-183f-8ad2-c4c2588ffa60
  4 6435aef1-ac18-2e08-8994-1dbc4d9b1879
  5 692ea28a-c8b0-1220-9529-8096caaf6f5e
  6 c86a3f9f-2bc5-7a2b-a69b-64d22f8a3cb7
  7 336108aa-b303-08d4-9a3f-79f010027001
  8 84b4ccb1-378c-74e8-9006-9e211ef3aaf9
  9 8c91d8f9-4802-1ee1-8215-10e426935cfa
 10 0ae56ff2-19ce-350f-8151-27508a945d14
 11 5bb06521-d0d5-2496-9d45-c5b58244b406

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 76121707132. Exactly this sequence comes out of new Random(228).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 0 of Run 4 (seed 664,106,302): new Random(664106302), Next(8,24) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:07–19:12).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related