201206261339 vncf3

explained decrypted filler

3DES(name) ECB, 9 GUIDs, seed 531

Metadata

Post ID: vncf3
Title: 201206261339 → 2012-06-26 13:39 on A858's clock
Posted (UTC): 2012-06-26 20:37:17
Timezone: UTC−7 · title 13:39 against posted 20:37 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(531).Next(9) ✓ verified
Run: Run 4 (seed 664,106,302) (seed)
Draw: 9 · predicted N = 9 ✓
Machine boot: F 2012-05-15 19:07–19:12 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

7CDE7541F87A5F2A CBBFDBF97B039EA3 2A6FBBB40296CABA 42BA6B30FA9862E8 15A683588280D69F 7B74A95A7AF78E09 E4D6046E800186D3 1E1AF9EB25C73750 3ACDE069F94EAD29 4468A5BA76AC7D26 EE265D648F003D39 9D36A36ED1CC5F91 50063D368ED01C38 1A1FD9E0D266FFE2 7D00D5CEBAC5EEC0 093D1117960E8A0B 13EC65391D01B644 09225A154E207FF1 80857937D9692433 9BA2AC3970FE4096 2D0D815C0A0F7436 F8574884D02B007C F19A10790D5274A6 BE7E9A8934B09FDC 7383213A0386EADF F1DE97A01D1A828B 6FABDE02DCED0F87 736FFDD85E1A239A 099F66FD23F24ABE 04D6A742B0C0642B 4F792B613C3E4EF5 8F484A5806CD2267 3FC096948CDBCDED E257A84423062C3D FCC3A7AF8D92BED9 E97AECE854FC7094 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0c12480a-ace5-1a0b-a2fb-ee671cc921d9
  2 ccc886b8-ef44-5bf9-ad63-eef1ce564abe
  3 72d4ff9d-4b34-8222-825a-f855bae47447
  4 b37908be-8cd8-8b7f-ae30-173de89a5ee0
  5 72a9ea69-814b-8085-81b2-247055b52d2e
  6 e4d99cae-6c89-50e7-84b6-95635a350cfa
  7 062590ad-fcaa-77c8-8a96-e753ffa3e96c
  8 9518d08f-500c-7182-ae37-24c256f12238
  9 3485839f-4c85-6c60-98a2-1a0214ae939a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 158885776. Exactly this sequence comes out of new Random(531).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 9 of Run 4 (seed 664,106,302): new Random(664106302), Next(8,24) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:07–19:12).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related