201206260856 vmu0h

explained decrypted filler

3DES(name) ECB, 19 GUIDs, seed 255

Metadata

Post ID: vmu0h
Title: 201206260856 → 2012-06-26 08:56 on A858's clock
Posted (UTC): 2012-06-26 15:54:47
Timezone: UTC−7 · title 08:56 against posted 15:54 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,232 hex characters · 616 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 19
Filler GUID seed: new Random(255).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 5 · predicted N = 19 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

52C2E00C2C1D43DD E0B5E0110A9FB0D9 4E186F3AFB43D163 8014C2AB7616E34A EEC4EC9010E9535B E4A81F849B5C3684 7EC488543A50D95B C7227F1D367ACE0E 11C9AF0881E270A7 BCF363CCD5AB1F37 A83278D259DDFBBF 33170BCC55F1EBB8 F1F063A14D5E805F 6297C384523C9758 698012A6FF088E37 47DA85B01F4383BD 8CEC2E909F12C204 036E6297E65BDA5B 1145BA6186B6EC59 9E4EF6938C6BACD1 E495DF6DAC9E8EBB FF16D41C43F0DF52 D848B6ED27095432 1953F23376CC4FEF 4AA2F06F7DD581FD 37436C1706E5B220 FF6415D5738A2027 58F465CC51D4B258 BB78E8ECBF03D8EF 0CA5A3E36C774876 08488753A291E140 12F175C30BAD8F33 EF060CC464087F05 818284397B11F8D9 A223B525CC505530 6996BB49E01CA521 B0B707D8D1EC38B0 6A36B7CD74B0465E 859B52BCB052730A 96DEAAA2ED0D480F 88B9DC1D02074B20 AC954E3E94697E48 EA39F3798E5FBDE3 08B1F95CCD2B7877 7716B4AC07D2D0F9 829D4513759AC5C7 99213BC8EFB1A89F DDB4543F1FB25142 AEC8ADFD170DC690 F8061552A42D3704 7EB4EA00A808DB1B 512E4A83D86C6666 61682CBA29CC1280 39719574E355E414 CE13F56F01F2F0D3 477F02A92B445245 3E4D9927AC064813 B07E5054C551D44D D67E2DEAC389B2BA B3CC76A1136D4FD0 D11EACDA76194D30 4AECA67BB72A68B8 0EABD9AAF827EB00 77D2BCCAA37C8104 3749D9A7FA519F88 4CD8B80D2168031E 1E9BA64CFA259FEB FB5AECD2E8DF124D 766C11C802208100 9721478340B45E44 B0151A4CB1F3A7A6 9188232796C3B315 98AFA9BADAE41569 FDC5E2AA3230B309 540649832C88BD1F 83B39E3B38D9EA78 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,232 hex characters = 616 bytes = 77 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 19 GUIDs as hex (shown below).

Decrypted: GUID list

  1 17cd64de-4c77-846c-8032-c04dac08e433
  2 0fa31c97-b602-5738-9b9a-682911c564bb
  3 889e1f9c-d547-0fa5-9c0e-e02749aeb752
  4 c7b6b2f2-d22b-8bc4-8306-cf1611b9bbf2
  5 16b19ebc-50c5-322d-9c64-b987447c6425
  6 270d9c3f-5afb-331e-b5d9-329c1ab56d01
  7 850957a7-917b-142a-bb9d-788dcb992279
  8 15ef71e6-b72d-328b-be95-ceb0885efa88
  9 2cb2a787-1c6a-48ee-83ae-5275e104eeb7
 10 da41b3be-f791-293a-92ad-ed476c9c9ee9
 11 1718ed38-8f96-15c7-bf38-f1b9dcc88092
 12 b31e8384-bb0f-4f84-b661-4ce355984378
 13 31962e63-375d-8c4d-a009-865ce3c14cde
 14 a0515145-ae76-1f3d-adab-6e1ec0391820
 15 ad50a95c-3763-4044-97e7-747ee504fe77
 16 3636d5a4-806a-21db-a478-e7d65d6bd911
 17 9dd480bb-e942-0e90-b053-e73b22a26da4
 18 85eeeda0-2d0b-03b1-a8c7-dfb4fc76d8e3
 19 2ef6d6fd-9fbe-502d-ada8-239d0e8cee22

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8508331342148142005. Exactly this sequence comes out of new Random(255).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 5 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 19; the post has N = 19 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related