201206261333 vnc0n

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 392

Metadata

Post ID: vnc0n
Title: 201206261333 → 2012-06-26 13:33 on A858's clock
Posted (UTC): 2012-06-26 20:31:42
Timezone: UTC−7 · title 13:33 against posted 20:31 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(392).Next(9) ✓ verified
Run: Run 4 (seed 664,106,302) (seed)
Draw: 8 · predicted N = 14 ✓
Machine boot: F 2012-05-15 19:07–19:12 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

B674A987680972B4 3EF8B01FDDA483A7 BA82CA3325A808BB AA8F3CBE9EC01659 BC159013A4ED7A1C E02DE73B562F2696 4D5E99BC2D0A6DE1 155BB1529453856C 5DA925D50065D97E 976B1FCD6E6DA916 B8CD3D228CD72DC1 3AA0E06C1F534ABA 55DBA40A7DB8210D 8C06CD5D3C9C02FA E4FB6CC5DF215349 3F2BEE35FEFAAC03 6827351270D3135B 1A6F9E042E9D7294 F23831527CA7BB08 6646172F50BEE530 2B0853A4681189DA B61784BBF2C22E93 55018C48F3505430 8070449576278B5C 07E1A29716E52366 2127C0A8929B04F3 62F87EBD80FB813F ED433B6835E4EACB BB0439C7EE11645D 08E6BD83BD4D28C4 67330F1AEEAC858B 915F62781AEF3D56 19D1E28CA5BA8813 CCA0894CAA93662D 7F88F9B787D0EFF4 6BE0B274497DC6F4 6E275CB7CC0ACDA3 0806E2123D903D97 2A6C326C34800456 C82A8848FDAA61D7 65A7C662E578FD12 479C2C0BF1C86F15 C643C8300A90C376 F06DBFCD302191B8 6BE4598D646C8050 09EB402CF4BABEE1 33D837128EAAD9D5 E4B4C850A75A826C A82AE5A7BB93C901 8E225C5DAA024B03 F0B9B4152666D63B 99EBC36E9B76B2E9 6A0B098CFD39D59E C8A14A9B7345DA19 226E1C8D102156F7 E5148A08CC5F7B8A 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 785fd2a9-76ad-4b6b-b646-5eb0946f0e17
  2 f4e581a9-fa4a-7b63-bca2-2616c3ba3800
  3 a18e2711-b424-6ec9-9ef8-56142b4f284f
  4 5fc5ae30-4128-2921-adfd-58d7d8444863
  5 98db3d91-0da9-15b6-ae29-a990cb9ab1b2
  6 a5db89fc-8f68-1899-a7c2-b041fba0ede4
  7 fce1aa21-0ffb-438a-a117-98c2faddec11
  8 41233a9c-4e05-0907-9116-962b3579014e
  9 30e2b2d3-10b8-48e1-8d5b-3c2548677401
 10 4f7e196e-dbcd-7025-a204-b1b0111b6776
 11 386ce291-676d-0bef-b425-755822fd29bc
 12 53148773-f668-4895-b611-3493ca9062fd
 13 ed6a4da0-3c87-1bc7-9ea0-fa04b70aeb81
 14 4e0b9b8d-fabb-3116-a8c2-7f94367ed8f4

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 47621140470413. Exactly this sequence comes out of new Random(392).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 8 of Run 4 (seed 664,106,302): new Random(664106302), Next(8,24) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:07–19:12).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related