201206260931 vmw2m

explained decrypted filler

3DES(name) ECB, 19 GUIDs, seed 63

Metadata

Post ID: vmw2m
Title: 201206260931 → 2012-06-26 09:31 on A858's clock
Posted (UTC): 2012-06-26 16:29:37
Timezone: UTC−7 · title 09:31 against posted 16:29 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,232 hex characters · 616 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 19
Filler GUID seed: new Random(63).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 13 · predicted N = 19 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 4 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

1FA847E2A9A063AA 51D6E0726C48AE65 9B634FCAA45350F2 D323A015A5B037BD AB670D2DD8EF3C6F 467D3FE41C332A6C D59005F464B7D5C2 2D38DE1E2A9D16D1 65EABEF7362709A3 4AD4FDEB4DC73E00 DB86AB038E25E398 5EB94F4099628F57 BD255923C05C38E7 E254E99DB16D340A 25B6BC6ADD4BFA92 BB7B7E576ED09494 0A953C41158A56F4 EDBC096FBAD583AF DC343939DB8FDE59 956298A2BEE40832 72C4531BEB58FAA7 FF61275A5EA0B0EE 07B06AEAB204C23B FF964C42456EB3CF 552A303B3B732A4E A450E63725A6A43E 8D96BDB6B732FF30 ED899EB9448C719C 70E59ABFA645FA7B 14ADC5C1186987A5 66321779967A88CA D0C7D06173BF9B07 E07A03C6EF3CAC48 4F1525B5509949B4 D5FC9290D30AC260 E04EB42A1E6F1B61 C27F34B31BB23830 C5D7B8ADAB93076F DEE88C665CAE9C73 8FD4F6C038CF0103 AF39ACEB479481D3 7A249A5FB145B8A9 77DD7C36E9CAEEEB 29B228A51A0ECC3B 6217956E6ABAC458 ACE2AD78D9EA689E 73CD90FF46A3E972 40B495288D1F613D 650561C7A2ACAF1D 522342EB3691B28D 4FF67EB78A5A2016 7EDB9F5CA38124C2 B67C0F726CDFF231 11ECC1A18FD3F955 4F908BCA84BA2E93 75EC7FE5BCEF3646 525087E947079877 FA1F4EA9B2D1692D 70A4293C3FF9D369 63EC57D4D48DC843 5FC6D90FC8F9A07D A2E9863B52A7E9A3 F409A6FEF6576151 0F7C7F609AF8A3A2 DFC669906E63A760 A5C1F01A37AAA233 3EE68A2E61A2B45D 9F577D1A0D3BDE89 3CBCB93A3E0E0B16 0809910417C7C446 398ED917E26C1CAE 7392176E0CFEE05C 571D3B9015CA700F 8A392B24EF3D8B53 978879FDF1DEB7D1 22D06B6E38EF0012 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,232 hex characters = 616 bytes = 77 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 19 GUIDs as hex (shown below).

Decrypted: GUID list

  1 77764366-3876-5a6f-8d5c-f4ef685fb949
  2 2face667-fda8-2be2-949f-9e6877ee004c
  3 101a978f-25ea-73e8-95d4-0841cc9e65e7
  4 b32272d6-b224-0c19-baf9-2de695d53e56
  5 2757c8f9-cbe2-5a07-b951-471bac03cd61
  6 04ca0d9a-0ef5-596a-a1ef-b61f36b3f3dd
  7 3d5764a8-a16a-1b42-8427-f84a1852c19d
  8 f55ebe91-32fb-0ab2-8bc1-e17f340285b6
  9 5da5cc03-fa42-6669-ba68-65a4f677f636
 10 11a3d443-28b5-4fb4-8149-0f4871416c5e
 11 498e5e72-fabc-604d-a87a-4be6b6ef84d8
 12 69e78256-cf32-5935-ad72-84f98ae655fa
 13 a1dd6d86-c3d2-8c60-8010-c69c94ea86b7
 14 e91e2173-ff0d-27ca-89c0-514e53fb0975
 15 76105240-3568-01e6-b786-3bb5c6b22fa1
 16 38a3400c-2301-3de7-9921-a4ac90fb8297
 17 8ae87c9e-ef9d-3aa8-b740-af94883e6510
 18 b7077a62-3a28-0f16-89bd-402a997d2df5
 19 d6ca5382-4823-38ce-87d5-1716f9da5eb6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5270551064658203303. Exactly this sequence comes out of new Random(63).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 13 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 19; the post has N = 19 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related