201206260953 vmxda

explained decrypted filler

3DES(name) ECB, 22 GUIDs, seed 733

Metadata

Post ID: vmxda
Title: 201206260953 → 2012-06-26 09:53 on A858's clock
Posted (UTC): 2012-06-26 16:51:24
Timezone: UTC−7 · title 09:53 against posted 16:51 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(733).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 18 · predicted N = 22 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

97E59954ABB5E7BF E32B669561A62464 02999591EF6D24BC BE5A4B71BD8A9CE0 270D7BC9B1893A5C F78FC66E06A6D8B7 CD116FD736050D6E 7BCF948AC5DB0084 F50622137126A2A5 8CAD10473D98B8B0 E7C91200B7AA8DD2 AA7CDB4224B2B513 A252C2ADB0829F5F F76D5850ED145027 0ECC260668C14553 452EFD351A121103 311151D162E19729 E5CCA86805CC86FC 14E9E19687017DB3 AEAC4A5A2A8E45C7 D1EBA1B9101CFE95 3008592D115918A1 E88953458C6CE8C1 B106EAB61E36934C 60B23F2694B32F9D 5FE90FD666C5013F 7BF2C0E9A1D59CBC 4D3FC7253E0E8F22 86E66A75516CC23D 552909C07CD4B5AF 954290572D6B1073 FB8DC55C8AE1DB71 04E2887F9D70172A D006503D7DE752CB 1B8E12D74272C9D0 582F754B9973CA89 8B6F25EDFD095D11 265161DEEAC457BA 30D1FD5A8D5948C0 5354B5D30D5A2B83 8536D432509CF5B3 6F4C911C8508C418 00240EDD04ADAE33 3F88C58C449BE2A8 68D8A8DE2716BAF3 35DC03566EF8D2AF 6850917F6284DB66 F18CE976F192A7D9 2FB624288900E5D0 54D8F5A0F4DF9D69 EB6376EB2F50DE2A 7466EB2BE9C97ACD FA09F3180567FBFE E800283C31EB7642 52EF5AF6B59D9FAD 6417ECA2C04F1BBC BF1F444F01E292AC E70ECA453A7B95DD 1B11070084E14AC2 1449F5EAE54383A6 D27E3AAB51ECB395 BCBA51A58C43FF90 59DD5C46AF841F83 ABE0522BA464C1DD 004E0FFC5BC305BD 12BD02DED2D432B0 A8A53E9DA98064C1 706B735ACA1F898D B1F077DD3E99DEE8 9C00EA6FA68CB4E7 146E6AC78ECC024D 4E9CAD39BA6536F3 A9A0FF2BC26A871D B9C6F5906EF526BB E246A4E09016EC30 40C666DFEDB808CF 07267C2393B0FE27 2E6C9D4B161773AE 13069E126658067B 1FF8BF49035794E9 8CD03D29B505C039 28918DD18EC0935B B85ADF342FEA61F3 CB6158AA1C2709D2 1C4DCAC7F21EF8F2 E175AC641958B236 AE4E8E21B81B1877 A9A0CFB52B462CDF 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cf79f2ef-3cba-5161-b8a7-cf5dfdf04f5e
  2 f14ba4ef-9bc5-8596-aa10-c9caad9fcfde
  3 a3415261-bc25-12b7-9997-bef787a4797a
  4 25ea8ef8-204a-04aa-a435-79b7437e3e95
  5 38624102-4a70-1d7d-ada6-a6e144fffc73
  6 48ba252c-ca27-166a-a3df-80f79d7512bd
  7 bf3cf2cb-ffa4-2e4d-b4e6-7260a4f96d74
  8 6f2d268b-d934-1088-844a-b30d30759e0e
  9 e9679474-ba91-5f96-b170-dfc8f152194e
 10 7f21e64f-37a7-509a-9f6e-d824e81a73f8
 11 44595df2-af8b-2a37-ba14-ede824fa4ef4
 12 c3607932-1b2b-656b-b8c7-7b72956d4773
 13 1e290fc1-51c3-4ff8-a036-7acd766e05e5
 14 479c626e-6a8a-7226-ba5a-a5b8c117a6b1
 15 949fd64d-b5d2-0c1b-8be6-814d2dfd53a9
 16 46f519fe-7ed6-7e71-844b-38acb8ac489f
 17 59770ca2-0199-8ad4-ab98-f8ef2743948c
 18 b32df059-e778-4380-a8a2-c905e145155f
 19 da7c1682-914b-4656-a092-b87c0fba9f0c
 20 c9d071ce-3899-1b1c-91f9-5bc9c270a66d
 21 9e56d3c0-389d-1c5e-9a8e-675afec1822a
 22 e6b88591-2fab-6d6e-80eb-1e30adf47bb2

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5810112155264707844116. Exactly this sequence comes out of new Random(733).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 18 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related