201206261311 vnakj

explained decrypted filler

3DES(name) ECB, 11 GUIDs, seed 691

Metadata

Post ID: vnakj
Title: 201206261311 → 2012-06-26 13:11 on A858's clock
Posted (UTC): 2012-06-26 20:09:21
Timezone: UTC−7 · title 13:11 against posted 20:09 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(691).Next(9) ✓ verified
Run: Run 4 (seed 664,106,302) (seed)
Draw: 4 · predicted N = 11 ✓
Machine boot: F 2012-05-15 19:07–19:12 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

28ACBBB9043F415F 3F7FB71CDD4E26D6 ECF98FFD4B77281A 72D9A5C6375954FF AC79380A56416B72 D0C1D7B5288EEF32 AD35D0BCC44C00C7 F9A48E866EDD54CA 29A094694BEE3ECE CBC6731D4015E310 60F0D6BE0B8F3FD0 22A95AE4840D1C69 EDCA9FC5859DA905 811942D3BA16342A 242F897DA35FD98B 8F68C9828F1522EF 14C1B0D212247101 D087D34DD594CA9F C528BB8E271E0781 820A11AA7C18A413 FF4C2CC679495CB4 65AE50A2C5F4D6B9 F9B12261C80280AC D71A99A19F4E6F62 FC642A32D0411AC8 0658DFDDAF30AEF5 0843D8635B13DA31 7F3142760F01A59B E1DB88EB53D9A725 2C3A4F186C90C5E5 7C2ABDED01C5103E B039DA19C277ED89 8E492F2238F8F87B 78FE515460D14391 EC4F26D3CCAE0DBB 79E62EC38CE34CF2 F5655432E7E5D8D2 ED4EB37B257A2141 B68BFA0EEEB63F98 7A6C5C114A9EBA94 C3DB26DDC9E4BCFA 69F3B4F558787720 DE61541E05A8CD63 7A2829F149B53398 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 db3e6033-b616-63b4-9f4f-bd126de0fcee
  2 f2b1da30-17b9-567e-9386-9cc7b06626eb
  3 69dea336-c970-63b9-a85b-182362b0d50f
  4 04fd03cc-8169-077f-bc1f-c0d43ce85ccb
  5 0f0455ed-3a43-1bd0-8106-e87ca0bcceff
  6 69140901-edf4-337b-9ffa-fb1f0d198d30
  7 f6ef0448-ff53-4626-9f1c-fce685d6983e
  8 38c34e5d-1159-0ab8-a63e-b3d524397f49
  9 36a2dcb3-f46a-4733-a37e-940567ba90f5
 10 0a1f5306-2cfc-0b54-8c94-730bddbb980b
 11 107e75d9-255e-3fbe-af68-bc7bdc1b3582

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 65601340403. Exactly this sequence comes out of new Random(691).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 4 of Run 4 (seed 664,106,302): new Random(664106302), Next(8,24) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:07–19:12).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related