201206261259 vn9su

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 566

Metadata

Post ID: vn9su
Title: 201206261259 → 2012-06-26 12:59 on A858's clock
Posted (UTC): 2012-06-26 19:58:11
Timezone: UTC−7 · title 12:59 against posted 19:58 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(566).Next(9) ✓ verified
Run: Run 4 (seed 664,106,302) (seed)
Draw: 2 · predicted N = 12 ✓
Machine boot: F 2012-05-15 19:07–19:12 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

855C5B0EB160C3B2 E24119F8289F90B9 34958B98EF2C6DB0 004CD85935D66F7D 12F39F7A1838D956 3FFD0B50D0ED9126 5FC0DF25F0EADB80 6D9CA92161449C63 E0E3C714EC1DCB80 256363ABC70C3B74 42349BB87AD70897 80DA929331F29474 4F6655951B4DA4CA C8AF1390CDD5BDD8 96A18D185BE8FA17 155FE0AABF7A6C53 A3C4B8814AD47A07 81B89B93DD0373EB B989424A2B9D7CCB 10B0A67F8E8295E4 98179E58B4DB77B0 E600766E338D381A 700F934E42672262 8ADA94085CB9658B 3CE74A45EEEDDCEC 9CA5672DE830DB35 42BC59D14814541E D3C3116C609A77A4 02E2B62DD01F081A 64D446A65910A257 0E5A91109157BC5E 0B7E6A53CEB03E8E C63C2261C728697B D19AB39F36576625 27F8DA7661C7BFF0 D11353D0AD2FE78D 30ADE2289A386689 39BDF72FE2D3620A 551975F40F4F5C45 10CDC1EC7D8AEB19 461D5D30005113A5 04D1F8822E1FB516 5BD5B94128C31FB5 F95EED2367BE9029 0CEE16033639882D 31935B15A9988D47 2A5B9103CA2DC635 5C4DD40C278E03E9 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d14edbbb-a412-35d6-a5e8-0f54feece74a
  2 c72a2344-47a6-8015-88cc-2814f2f6e9fc
  3 e4ec8403-b6e4-3432-b800-a7de3550696f
  4 96655327-592d-30ca-a513-ed0772ddf804
  5 0b4251ed-72b9-6825-9a5e-5a338be599f3
  6 b341fde4-91d6-1531-aba5-439bc2f4fa59
  7 fc7c754b-3b58-4fd8-b29a-61ff5177da15
  8 6bf3b1a6-8153-390d-8b88-039040688354
  9 caf4c657-957d-037c-aa96-6f3991e28b84
 10 3538cc3d-95af-85b9-bd0f-90cb159b8b84
 11 782dada6-e12c-2233-b6b9-14bb77dc69d4
 12 12d7136d-bc9d-365d-85d3-68b43fc9e5a0

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 383361430823. Exactly this sequence comes out of new Random(566).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 2 of Run 4 (seed 664,106,302): new Random(664106302), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:07–19:12).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related