201206260827 vmsae

explained decrypted filler

3DES(name) ECB, 21 GUIDs, seed 628

Metadata

Post ID: vmsae
Title: 201206260827 → 2012-06-26 08:27 on A858's clock
Posted (UTC): 2012-06-26 15:25:36
Timezone: UTC−7 · title 08:27 against posted 15:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(628).Next(9) ✓ verified
Run: Run 1 (seed 1,054,668,128) (seed)
Draw: 0 · predicted N = 21 ✓
Machine boot: 2012-06-14 10:27–10:27 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

1CD8D10A7F4F1A11 78B07062B2AA61DE 8B941BBE3A6474C3 82E5AB54F431C31E 01D41F5035449624 4B60C341E3978267 31D0A0DC45F41B63 ECBC5A1AC6CE4357 63D5F12B64214547 134CD12288B4D269 40F7D12427C79A5D 98CCCEE4B1A888E7 0137E38149CC6E3C A1DE652E2A536656 C3C8B83E3B44B57B 8A38FECA7583D21B E4806BFE1C02C2BF 8DA8D34F0A17428B C373128E2895BF44 356BD8EBCDBD6C93 E7C3F687A47F6F39 060B67B40D9890A2 9B8F3E5E50D4293B FEEEEEB43DEAC2A3 A8663C5EC8C34E23 7EEFF04E4B295878 B5CC760FC343A3C2 A89688FA8D971489 52DDC575AD53A549 487E00EADED0F565 E6C6118C3B178261 0291C4B5338FD6FC 5C7D0FE9AE51DE2A 70A354FE9DB5617F ADB1F3B28F031643 7B522107AEB1C172 8AE2F654AA0F26CB A4DC3A41B8EB0D3F 6D5768B4C9666541 63374FB8F2DED418 2FDED1480CF01E37 8036834165091F45 987E4310B3D128B7 88CE046DE7B4B321 C1717175B54EF918 751EF9B558CBF339 E416D196525E39C9 D169848FE870F833 7DB043E631951205 A90476CD1DEB75B5 5DAB37A917565717 85C876733D82660A 5A6E4DDC4443ECF1 E72BF2D536C0B223 7B363315CE164665 08E937997E42B644 5E33DB0131A7FCD3 302E755F970B00BA D2EB2D2F891FB86B B54363AD8AC755C3 50A3B827F8F1310D AEA7C66DCEAD1DB0 37F7A7DA0AFB2E62 BD1EC921D516D0BA 23F175840D789A3C E5FF3C3092B55390 F729EF97578E30AA 3AA5305F13372618 27F783BD79877C20 92A247BB4066AADC B8D299212D59A4C4 A1B6326A0B623F61 FAB847D747D19C10 C1BB2816341DCD0F 6187DA04065DD909 BD5B8B5E1F337341 06F24030BD39A66C F636C69889284A9A 757591D951FBDF0E 490628E8BC189FC1 E7C20BC669971203 6D8F1FDC011C089A DDDDD9CF8F0ACCF6 5B65CE4D7E9F9A1E 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5ef879bb-9911-74d1-933f-610b55476b5b
  2 218b5d06-eaa1-0314-9c7a-6a67e8e3010c
  3 78af5767-a9d3-60c7-94ef-daf9dc8f35fa
  4 42d706ad-1ac3-584a-b7d3-d17fa9305515
  5 171acffa-8004-61b1-9471-fa7916ef2429
  6 62124e13-5d84-358e-9cf5-770e20090fd7
  7 6f05d035-cb90-2c0e-91fd-45523e044b20
  8 db159ac0-fff6-4abd-a31d-a32173462e7f
  9 9b5f4839-4642-6cc8-ad34-ab9d762dc16d
 10 62e04f20-8aee-7990-bef2-83c9ce6cda51
 11 7e0eecf8-64df-8405-bae1-fe3d84477f4b
 12 43692d9a-5d49-6da6-b997-5012355d071d
 13 d7e2f7e7-d829-3dd9-8dd1-5dd6a37b45e0
 14 2781e931-9376-1f38-a45a-e839f18ed7ac
 15 5e3d64f3-9ceb-5314-a45a-2f71612b5a79
 16 38ec91db-308d-28c9-8917-1fdcd2ce6de3
 17 dc7546dd-e296-7ed5-a493-a84343ffbd1c
 18 ef3b6733-cdfc-3334-adc7-7144b6d832e6
 19 2ef191ca-7023-6a18-9c29-5d758f39e48b
 20 340d06e9-942c-4abe-a31e-da1fd5edbc6e
 21 7821fbf4-3218-2796-afa4-f4a821beec62

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 706563246786315273642. Exactly this sequence comes out of new Random(628).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 0 of Run 1 (seed 1,054,668,128): new Random(1054668128), Next(8,24) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:27–10:27).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related