201206260909 vmus0

explained decrypted filler

3DES(name) ECB, 22 GUIDs, seed 992

Metadata

Post ID: vmus0
Title: 201206260909 → 2012-06-26 09:09 on A858's clock
Posted (UTC): 2012-06-26 16:07:50
Timezone: UTC−7 · title 09:09 against posted 16:07 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(992).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 8 · predicted N = 22 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

37B962CC9E40D775 5C19CAA796B4DBEE 2171D66AD3748858 3E3C5F1B1A3E5989 EC2BE752C3861392 70258C41E59AA34A A0FE2EA53911720D 69804D981776094B D7EC253F0BAA659C 846E9A357433F1FC 08CA7676AB18F2F4 45DCF38D646AD017 FCE12BC754F7E568 DBA3D72121E64C0B 8CB7791780910FC8 A573CE5B04CF6370 F8C93D0D1659DA33 5140EDA1C968F390 04B4270258EE1F79 4856F4E16037D7B0 41CF4897C112C7CE E1CBF846CA051F37 9B38917165CA82EB A560A576533CA5ED 04D96FB80D2342FC C762D039B2CE5316 1BDD914073F4F930 DA965ED07A42982A BBDE26259EC0ED38 FEFCC1B590C96D1E 5F05648A426731B8 1443C40E03F43044 B422C688E8DC197D F295F511FD1F33AB 8CA293B84B845C65 872537F430932A1F 6093C7EE06D20ECF 039B33F42DDAE26A 027330A8ABA9F054 CF773E87605FE711 E94ECC622C045426 C1E02F71D8D1FF6C 90FB85F21BB405A9 0375023FA7297C6E 8B02C81D6E2E4672 D414D904803626BD 329022B04AC72E2A 347F48CCC01E4B1E 5FF4CA9C1C75E2F8 017231C4671517E9 B39CC522742CFFAF 836FC05C39EC5088 035C38CDA128848C A62620187319BDD6 B8A1E15FDFA4459D 3666B742F03D91D2 1169B98CC6A1897B D824E3381F7D2099 C9DFB329AD3EACC8 87C5F4A081B2D1DE 780B4A273FEE821A AC2CA4F68C1EDEC8 CE1304F4DAC697EE 71E56DCEEBA651F7 22F69C162E0DA78F 3D0752B5802F2DA6 7FBB780552ECD74B DC62768CF2B14EE1 0DD0BF56DEC9300D 17D3089A31D98D05 743973C42881E271 57C1B8153CFB43E8 7397EF2CA71D116D 5FF6C5FEE07F3213 B2D1F22B6212DA2A 3771736293721F0C FB49416A83FFC9F3 D52BFF34C1880266 897743C438FBED86 D6112F1BC77200E1 45D834ED81B857F7 84B06759C045C779 87AB5CDCDEDD6BE7 6A3580A06254EEB8 0D8B252E792FF337 ABFD4A970685B48B FDC48FA97C7C0D6C 6ADF4BAFC4B89E28 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 38d7a6a7-68b8-80f7-a41a-1394c257f7a2
  2 c5fa12a5-b7a1-701c-b3ab-405b747a6519
  3 1007f70e-8ecd-12af-9214-e6370a0cbc02
  4 fd4bd413-8591-2aa0-b229-4ba3011037be
  5 1ab04650-af5f-05b3-be56-52611f1c5c89
  6 daca6fc0-a8da-4cbd-b1e6-a9432eee1c2e
  7 2113d9ca-18fd-30b9-8e87-633f5e149393
  8 aef70e2b-935b-1e00-8552-af65343873ca
  9 bd5d699c-686e-683c-9a35-b7339396c7fd
 10 31c2aa95-8749-0bd3-85ee-2b65b28ec9ff
 11 e0981bf2-a122-1ad9-beb4-6ebf336ad373
 12 32b598ae-979b-843d-847a-69bffad31ca4
 13 98583e5f-3101-5e54-b257-4515ad050e07
 14 25dfa871-065d-5346-b3f1-a4bff3861e07
 15 ea7d030f-0a53-3d2d-8e99-3ec15f8654b6
 16 15261b25-8e40-4f7e-a0fc-146f73b28402
 17 cf2f3788-a7b6-7ce7-826d-a20a2db9ab8a
 18 d75ab8f9-51cc-08e4-a53b-453721261630
 19 13746b60-dfbe-4cf7-9928-8c0940a4c5be
 20 e9363bbc-7d52-3fcb-bf06-6712135ed1e4
 21 dc294596-d1bb-5b99-863a-0be335e0c19c
 22 0f6bd5c3-e420-1121-824a-179feac5421f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8712043160185534704351. Exactly this sequence comes out of new Random(992).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 8 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related