201206261631 vnn58

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 787

Metadata

Post ID: vnn58
Title: 201206261631 → 2012-06-26 16:31 on A858's clock
Posted (UTC): 2012-06-26 23:30:13
Timezone: UTC−7 · title 16:31 against posted 23:30 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(787).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 6 · predicted N = 12 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

88DB7883E8AFDA37 9DA1561B51356721 9567A07C6243ACD9 EAC4B497344259E8 8357B4E297290DB6 28B7D5BF223E5DBE 2D39C3D536492E1C A1ED528AF2B98E6F 0B43A46626A62718 9D2E895E4D4C15B9 F5AC008D4D683B88 CDF528FCE4064669 C73AF6DE737D84AA 51EDA438BAB7EF2C 47E9939C916593D2 C9A469921B444A47 7535284B816F5A02 AA0DC340FA1ADA87 9609F5FE005C27C6 05E9C073C2541CA1 444F32B42888C549 9BFD2E0D28F3361F 0FF201AF0A80A4D9 2B2B0110AC09438C 5BA38D04FF755099 DDD6AC428ABA670A 92ED3FBE3840F57C C56937CF3B69A0FE 0CFF4F49A1659565 14BA7F889524B770 81A079E0A5D5960C 443E7138235BFC4C 459870A3B55FC06B 3030D082CFE3F923 918FC5CC96B5502D CF8D074EC856DE80 7BDC452CBC3B2DC6 59C594ADEAA6E958 DC1C813172D3B34C 11680E1D457B34E1 294F42E3727F038B 99A1B4A04AD53A84 117CB2CBB09377B1 89C13EEFC9093C59 640E353A3A56C37D D573E4AB9C5BA997 B1D74907CC933738 FAA1883DDA9027BA 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 40f4061b-eff9-74e1-97f1-01a96ff09b1f
  2 ae1d33f7-a315-6a87-becb-fa54c4ff36f9
  3 a78989a3-f89b-7ec0-8f02-71446eac81e1
  4 567a4750-e4c1-48f8-a92f-9e2f74c6e1cf
  5 677f9f15-f210-485b-9e88-fe9171a067ae
  6 77a3f5e2-6b37-2f8a-b415-32608469973d
  7 944e4ff1-119e-4be1-ba3a-3ad9ef8bae32
  8 567226dd-647a-2490-856e-c7936c7ee1d8
  9 a0bc752a-e596-3e4d-996c-da061d2e2ca3
 10 a4f344fb-ee42-4afd-82ee-57d3e43d51c9
 11 bcbeea49-610b-075b-ab92-292f30a77b7a
 12 9f8a4f1f-21ed-8adb-aa04-95f70505e64c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 767442423408. Exactly this sequence comes out of new Random(787).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 6 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related