201206260940 vmwkm

explained decrypted filler

3DES(name) ECB, 11 GUIDs, seed 154

Metadata

Post ID: vmwkm
Title: 201206260940 → 2012-06-26 09:40 on A858's clock
Posted (UTC): 2012-06-26 16:38:20
Timezone: UTC−7 · title 09:40 against posted 16:38 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(154).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 15 · predicted N = 11 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

C4467CFF75417A13 1ADBA33710D22B7D 0E52DDFC616BA32F 931A5D9E056AE6CD D6E6BD07FB2EB8B0 86BC37872C05EF04 60DA270FB64762D2 E3F2328347755279 24B705D60ED7C768 C76937F57168C3D8 43545F4CA1A68E63 74B59D570B715E7E 784306DFC9A70270 26B8168B0A3D14DF 3E1CBC0FD3F3B125 8338CB827A2B45D6 99441393A7F43A58 D594CFCF86119AC5 696538869EB38CD6 C62F299F23963E36 18CC5E1EE4D57506 E33EFEDBA2AC68BE A8790A30206C6D09 568BB9E5D10CC9AD DDDD13F3EE88842B 439283BB547898BE 0BEA8242DDB5CD9E 07EBB11082574F72 329193369387D425 FCA417A9DD9262C7 3C196FF731829156 E854F7068083A69C 4A092AAB077F03FC 96269A0DCF09A9AB 36EA089973EDEA14 69ACC9FEB2714E3A C18F506A3DC8410C 676EFE4A964EEE5D 930C4D8A8CFD661A C00E7AD4897E1572 DE923326B847C52F 78626E74C5FC7FE7 470799E9EFCBE701 80F9D55BBD96646E 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 dcfb356a-f194-1973-969e-7a42b065324d
  2 51e41db0-9cda-0049-bc3e-4c562f8ebf00
  3 0f5dea8b-f996-3094-8d26-1ea4dc765d89
  4 3547308c-f61c-3cbd-8d56-ec49ce6ffb30
  5 a7a51b9a-e046-6b92-8ae3-0fe8f841285f
  6 20f4b876-04d8-1c82-8c61-1357ae82c4ac
  7 81a9c81f-145b-8ed9-8c70-c17771f157ee
  8 1c89dc6c-36ac-63ac-b55b-aff069e36426
  9 52bddf56-8745-0dba-9125-3dcf58c5a096
 10 6f36f615-08c9-0f69-bdd9-129b116f4adb
 11 df3c8c22-6a6e-6cc3-b38e-15331cb0bdec

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 10336186006. Exactly this sequence comes out of new Random(154).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 15 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related