201206260838 vmsxu

explained decrypted filler

3DES(name) ECB, 9 GUIDs, seed 523

Metadata

Post ID: vmsxu
Title: 201206260838 → 2012-06-26 08:38 on A858's clock
Posted (UTC): 2012-06-26 15:37:14
Timezone: UTC−7 · title 08:38 against posted 15:37 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(523).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 1 · predicted N = 9 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

EF2722FA5B0EBE93 6B68F44C5BFAF82E 333979FDAB74FACF A1BE305695291622 D6753B0D5C18E66C 5B322A0CFC816E31 BF3ABA418501DF0F AC96EE1A06E20C54 D4B62D03F8456C7B AB1F7553E5BCC183 D47653DEABBF4F7F 2CA58B15E4AA4D5B A9ADD460A11DDD11 4C89E62BB0997338 739D3AB2E9EF0737 969EA56AA2BBE49A 0B6E9532829DB128 6895EDBBEB90F836 5ECF367E0D759AA3 33619280F183DD3C 104F358C223196B4 F2A24268AFFDBA68 C9CB922B78F4945A 4E1F733229BAAD29 75E30CB9E634EE01 CB883460262F9368 F01B3EB4537209C5 2211E8E59284A405 B5EB1F63A8FD6EF8 24F3203E11C36A42 B1230DFF44350791 DFC2C1DC2D925C86 38018542316B59C1 9F6E0DD66B37E02D 37D6F8D94C8D0335 4C5684E51C76EF00 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9c8e53a0-dda4-89ba-91e6-f1e897c86a2a
  2 3a2b3dcd-b516-2cc9-aee8-fbb4d59bd446
  3 d2809ea8-a075-306c-8c8e-f629ffb1564e
  4 c1bdf130-a130-139f-b9dc-7dde7d3cbf0a
  5 cc1a9a74-286b-2067-b772-516cbd4213b1
  6 8dcb4912-0120-5291-a4bc-3d3f521337a3
  7 ec2215a9-54db-22ce-98be-fc37ec306be1
  8 1c960d4e-0f25-7fe3-a222-06fb023daba9
  9 3ad4aa88-4b93-651a-aa86-a8f9a8e03bf3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 823125276. Exactly this sequence comes out of new Random(523).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 1 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related