201206260900 vmu9t

explained decrypted filler

3DES(name) ECB, 20 GUIDs, seed 220

Metadata

Post ID: vmu9t
Title: 201206260900 → 2012-06-26 09:00 on A858's clock
Posted (UTC): 2012-06-26 15:59:08
Timezone: UTC−7 · title 09:00 against posted 15:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 20
Filler GUID seed: new Random(220).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 6 · predicted N = 20 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

72E81F0A31693FBF 95E6854C718970EF AFFC1DF8D2571D1D 74E4BA9BEA3704BC 778457E3FAD8F198 6D6B3A80781FC3A2 567A74C01A35F879 971D746B2D3515DA 3A0A41EFC5D5DA6A 3C1942785F20552E 23B20945872ACE54 D76701E991A09D8F 09D5E1A1FEFF9EFE 3ED5ECF23EDBAC9A D99E66341CEA436F AAD9E806264D92A2 0CDE7B834087E8A7 547520AA2CF704F1 9D2ECF9CE5975D61 EB83244423E294E1 110A839AFF5B1162 8856BBFE116A79DD ABF0D93F77F53E5E 25C965A2F83E8156 4A4E316860E8EBC2 E9EC57FD97594C0C 55F87E049AEC3AE1 84DDCC5719FA1941 ED4DAA9238EA4F0B 22268C0C2FAC134C F0973B04E46A0A57 C321F67064EFA452 7C738156689AEBA5 40DDE1A5563A8FF1 B0FD6948C8484D32 54339C87D592F491 CF329E7356067E10 210A9ACC2B7CD01C B466D1C4DCA00B81 183E499928688DF4 20C70430EC451EA2 00926028996AA2EA 172076DEE96C14C2 C8CFC66D9D7D99FF 02BF231207B3DE2C 592611C26D32C25F 4E5ECFBEEF1C59C8 0421A855EA5FCD00 E9033DFACA231DB9 655C9F8E313500F4 852DF2B0B45FD4F3 FD23C0C0FA2C9FC0 1D14C188EE9AA8C2 891910470F8308EC 5C4D57738DB46C2C 65C5A562C9BDB7B1 7D5080C0017E5C0F D7F1BF07CA30746C 28BE213A768782DE 7EBA51C38ED8C4A1 8608CC85183F29E6 E5295D92DAB7F53C 041BC3257C86FD8E 47F6F5D361FAEDBF 0D8181B0B2AF4723 D19AC6441E5A4133 D3D82617DE09F636 FB6E9C8C4638F39D E8B07FBDAC0E8378 1227E35C1AAF4D6E 993C45DF2EACF2A9 1DCF27D51CFB08CF 5DC9A6C2EE0D3307 731A807CDE00E92F 9299416EFE0DBA0F 4C68A8AE2F42A943 9BC4A437054733A4 0447F3516D2EE1BA 024B209623F1C87C 347C23760288D056 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 67c3d216-1d25-553d-b39a-b4409ab3b130
  2 23287490-1f32-38af-ac2a-c78e963f209b
  3 45119937-f8d9-4c16-a854-01b39266fc3e
  4 ccf38ff4-7138-47d3-b51a-7de9e5a7095e
  5 ffc62213-2730-4624-8b3e-d2b6febd87fc
  6 1e430ff7-ccc9-781c-a26b-e43b305a82f3
  7 40f6be54-56d4-4626-9c2b-478796d2113c
  8 4e4939b0-d537-75d6-b757-65bad003ab63
  9 00c4411d-9921-19c8-a770-3a3f8793c6ee
 10 e1b3eb62-b8b3-31ee-aa2d-3dcffa914c27
 11 6245e1a0-4334-3ee6-982e-7dc6f22d197d
 12 0d35e20c-3371-2f8d-90e9-0559b2719df2
 13 308b57fd-fa04-730e-9447-f47d7203cc4f
 14 ee113f18-5567-8a1d-ab2e-4b90e427ea9d
 15 807271da-aef9-869d-a38d-e615d02276bc
 16 704e9d26-9c9b-3b00-96c6-e247e5bc6e34
 17 dd6a8233-8a66-340d-a9cb-1d86fb6f51c6
 18 72bb6d8e-a982-3b80-8bc8-dd03f6f63a5e
 19 2ca8a21f-ec35-57eb-bdf2-4057d2372974
 20 f6af836f-65d7-4a2e-8c1e-93290fe29bc6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 53444747133278833354. Exactly this sequence comes out of new Random(220).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 6 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related