201206260852 vmtrb

explained decrypted filler

3DES(name) ECB, 8 GUIDs, seed 136

Metadata

Post ID: vmtrb
Title: 201206260852 → 2012-06-26 08:52 on A858's clock
Posted (UTC): 2012-06-26 15:50:26
Timezone: UTC−7 · title 08:52 against posted 15:50 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(136).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 4 · predicted N = 8 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

E8A2656C4C22B22A 223F672513CB7ECB 1FFD9DA89627D12A F5F64C9DB0966FD4 CF01643F03728E9C DBE5DBA8B41571A2 FD265AADCF748C85 2E6ADFC9B10F6B52 D336EB27A1BA4095 1FE3847103DC4D38 DCF1CDDEE4E8C901 E14AF983596C4BDC 38A152503D9D98A3 C8331D673B6BFE66 9BC0C94288F3F071 2031AFF2C2BBC440 2B1E3ECCB0E9C9A5 9A5F1C9A4E46DBC4 92630807C0EBBB6D 219C94A95857320C B6417C34B434AD39 401991C9ED44FE00 2619308C9B731B2F CC803A97F1AC12BD DD0AF5C12C905404 C937916485709A5C 297C60EF9C46740C 95436AD55A3B3CB2 030AD0CC89A6F394 ECB4A323C3838B05 DEAB7EABBE85A6B6 8F1B6F3BF2CF66D0 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 18ea80ed-856a-6601-a2f0-e27a4e0f8b9e
  2 95e3c900-93f0-6843-902b-b769de4fd71d
  3 42930260-ad03-7a47-af46-e93833c6a708
  4 b420b717-e6d6-5682-b942-63270921c734
  5 6bf42a5a-c59f-5cb0-97ae-1a16cb9b6576
  6 cbd126e9-3651-397d-a3bd-a137decf3c1b
  7 5a0e316f-3d2e-748a-bd25-c5bebafe127d
  8 5fb25b22-7f20-6421-bf86-05c5949c387a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 66755376. Exactly this sequence comes out of new Random(136).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 4 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related