201206260918 vmvaz

explained decrypted filler

3DES(name) ECB, 18 GUIDs, seed 577

Metadata

Post ID: vmvaz
Title: 201206260918 → 2012-06-26 09:18 on A858's clock
Posted (UTC): 2012-06-26 16:16:33
Timezone: UTC−7 · title 09:18 against posted 16:16 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(577).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 10 · predicted N = 18 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

5E64929D6EAB381A B90699BB15FB14F8 9C0B6D4E3C284845 8BC46082800E2A13 562379CAA782C549 3CF8757C8BF5987B ECE152EDD3EA3328 EE73E7B08AECE280 17EA78FD3A2E7FFC D4B6E59CD7026663 76258492F4905904 76018834C76DF2D8 9B226FE51F540D03 99D4F18C67A4E275 143BE91DACAC27EA ED2E346E91F0F98F AD7F90F948503819 BAD3528384A15426 5E0F6421E7A14BCF 1E527E11BA789D02 49CA3F9D505AE866 D84B089D5A7B3428 BFE02EE502BFE8D4 2241F0ED8D1BFE14 452B431ADA22767C 7021314BB2B0288A B3FFC1907F200183 E53FAC6E757B1FBA 66CFAFA7C7991980 07353134075FC345 911338D45799ECB0 3CE7FBF61AC0C9A7 F2C2A5277611CF02 8E88B673D987B0F5 93AE29D4BD57CF0E 2294F2DCE5DCEA5B C87D196203B886C9 10693F39105D5B13 109E6693904DF7D1 DC74158F160C43CC 5BD4BD1E5C82C2A3 D5BF0B6E1F2A18EC A5F5FF709899DAEE AD36836D6E798395 58867DFC04AE5E85 F9862E5A685322F0 297A0309948E5574 D0BFA878711FDFAD 56DB225F8DFB0E28 3682A875C19D6379 E01AAFE251882631 33F4D45F03643157 5C4D9A39F54C88CE 7ED47920B0A3369A DCEB23E614AA39C5 2CDBDC8763344EDE FD5C7A2E8423212C 8E51909C35D4B303 28B018B61392AA1D F8DFC3C5ABBD8655 611423535BD8F6C3 35948C3E48CFCAB1 A7C59AE93BD3B76E 235B89A1B41E87C2 9D1DBD6066CAD80B EEBDEAF0ACE2DAB4 FCE1B3B35D565174 FA16CC9F0A871F46 5DB02949F2AA2E2F D044D21DEFAB9DB0 A76AB78E775262F7 4CBC049257CA1C70 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a5e98da0-a2c4-1b56-9a89-86f63b3a1b22
  2 ed1c1283-19ee-16ce-92f1-99e57eb07096
  3 7f7b91f5-29a6-0149-816c-b81631ce14cc
  4 2dd25e7a-cf3c-6d4b-b4fb-5ef495c9c7c2
  5 78d7f840-f688-622f-ae41-50f6f8c67e75
  6 e1344a18-0d35-7a65-ac35-562cfb0ddc3d
  7 c3a780f2-06d9-34c4-b4f8-efd9a4d963be
  8 8f7ae474-89a3-86c1-9106-1d1d505f0791
  9 0ff8578e-e652-3e0b-9f51-0d112cd272fd
 10 dbc37aa5-1532-0352-9020-b888a1571a50
 11 ea0b44d3-12f0-31ad-a572-f6a193af737f
 12 5fc250a2-0f6c-87d3-be72-f8b79f3ad328
 13 1bb3396a-a37a-2870-a6b3-cef1698fcf28
 14 7d3ca593-a800-531e-9a68-20221f9dfe28
 15 68b4fc88-1d93-7e6c-aacf-46e77b1ba7f6
 16 0684075a-18c9-33f5-896a-0fbb6671b3e2
 17 dc5bbe53-0876-3a1e-b6d0-3ebc559b7b85
 18 3e516048-4ef0-6387-9bbc-03a4aff93c6c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 110667383038257336. Exactly this sequence comes out of new Random(577).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related