201206260828 vmsdn

explained decrypted filler

3DES(name) ECB, 20 GUIDs, seed 46

Metadata

Post ID: vmsdn
Title: 201206260828 → 2012-06-26 08:28 on A858's clock
Posted (UTC): 2012-06-26 15:27:05
Timezone: UTC−7 · title 08:28 against posted 15:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 20
Filler GUID seed: new Random(46).Next(9) ✓ verified
Run: Run 1 (seed 1,054,668,128) (seed)
Draw: 8 · predicted N = 20 ✓
Machine boot: 2012-06-14 10:27–10:27 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

E6ECF0654D62B1BE AA0F11A6E122F6AB 69C1935E00462D7A 5FDCA08F066950BF D4E9943A0D152A1A 37813D78BF57E336 7D725805E4A97D1E DF3489D8720DEC0E 4BCA0CA414CD12FE 16E729A28E779B5A BAC6524B850558A0 57D70B9F3D2CB0B7 7845804DABB371CF 504656F1C8C27B54 8EBBF401BB6D665B 5DB69D8913623AFD 42F3830F00AC2585 AF8743C8BB9445E4 4CC15FC650E6F85C 3F24BAA951CD96E7 431EBBDF79DE88C0 D81A766460F79492 B9C907E2CA43D203 D0D4CBF888AA7DA9 B06C83348E977C35 35184CACBFA3F956 2E120299C9689E20 F3125A048FC1E2F4 9AA7021111393A1F 6E8DA8C078490C44 2728B6B91FBBA5BA 93707BF2F45C320F 1DB173B449117815 EB4C84B2318B9657 20E2807469277C0E 120FA73B5AC18AA9 1AAC807D022A6BD8 D5CC3AF47806F9F7 0AD01323736E6C76 3B1CECC66F287C6A A2520BF3D13BE5FD F404F4889E4DAA1E 282992E7300110EE 058A32CDD8B17C5E 97C51E46DC9BEA63 94472F76BE59F6D6 A225E0C4F7938E06 C2F04AB5115C2D19 412ED7D0D1EF35E2 CE997DE7B0FBE8A6 AD6029EB70669CC3 431D7038DDD33D49 FCA62A5A332664DB E976937C83BE2925 60B85492BEBACE51 28F5290060E04464 63FB3015C0C9D6F1 2B22CE87D765E8F3 1489C3636719AD70 7E91A5FE01F7D570 075A2032CE6F3B8A 33587CBF89425673 C475C05DEDDEF61C 8CDC6F58B2596E18 C97EFAA57F4C4D43 3E1272CCF74100C5 5B6DAEB278699F96 2A4608C6F789B85A DF7B288A8B7F1901 C652AB7E18E4090C BDBF4B20786A0A3A A7CFB3B8EA89CDB3 52C24B0A7F674EBE BEFE9D3D29A298CA 379BBBCFE0A47A82 6ADA0999EDF8147A 2F3BE2A1F630EA60 7FF95E93080CF6D4 A6A559DEF951A0CB A64DBB8E5E39498E 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0a93e3b2-0254-6f7a-a0a1-006e8e2ce883
  2 5ffb2e67-3f0c-275d-bf33-0cd7bc8aebf6
  3 4daffc0d-9615-828c-b93a-082121b1c80c
  4 0a8859d4-3694-362f-9abf-464ebba891bc
  5 9e3cfaf1-1755-8c08-a4ab-61a52555f193
  6 9dfd7c8f-462d-6fab-ad7d-84a8b8df7448
  7 6b2c6a35-b77d-4d4b-8b54-2ce987c51aca
  8 77cf9bd9-195f-46d6-af57-a68897b92946
  9 1f7d4376-e510-6144-9bf3-dd407846b1eb
 10 363b9330-ff4d-2b7e-a1e7-0fc5a3d48189
 11 e24953ee-54ad-1748-8bbf-151bab4a88a5
 12 e77799b1-2ef5-3d7a-99ce-bd64f9c09a90
 13 148feac2-2f89-200f-9ba0-7f090058370a
 14 085a97db-7827-3044-8fed-c0e45b7385a2
 15 37ee7c0a-ceef-11cc-aa94-036040017a4a
 16 29884c85-6299-6a9c-89a4-2df51ff351ef
 17 482f03ed-c5b3-1435-8898-486087ca3d73
 18 96a375ac-bf0f-490d-ade2-0b63ca8118f0
 19 ae3f6b15-ab46-8bc9-8fde-b3f85f513f5d
 20 fa255110-3a9a-1bd6-b4fc-c74017fc95df

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 62838644621323161481. Exactly this sequence comes out of new Random(46).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 8 of Run 1 (seed 1,054,668,128): new Random(1054668128), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:27–10:27).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related