201206261001 vmxy2

explained decrypted filler

3DES(name) ECB, 21 GUIDs, seed 643

Metadata

Post ID: vmxy2
Title: 201206261001 → 2012-06-26 10:01 on A858's clock
Posted (UTC): 2012-06-26 17:00:06
Timezone: UTC−7 · title 10:01 against posted 17:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(643).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 20 · predicted N = 21 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

79DA6873A67A1304 921FA793F792F1DC 76ACD9C69370987B 560E5332A6AB7D21 74558EFA3920C2FF DC149EC4D43F2A3A C8C90DF54B2547C7 F8EC17EF6358693C 347ECD7A7728E12F 86FE9E8B257CE20E 615ED576CA1EB100 7F24DE245E270C4D 5710E19C1D9C94A2 6BE0D4A50A6CBD93 D6BF4D0BFF351946 AA215C5669CFB157 75BD71C0AB96FA47 03E4023545901181 1E4AAB349AD5640A E7134C3BD9ECECDF 277F77E4869E1C14 39506BDF5A01AB8B 7A72416A6BB1C8AB 81E884561B2947C1 EFAC870E7A60E8D2 D40D438F0C8F3684 132C40A120087436 28FF2D6CC8280C00 EB6CCEDCE93321BF 01AD9FCA71C1826D E215F4D2B68ADD4B EAEADD36C831B1CB 0B57250BF6533327 57E6464BC4303C5B CC05BD9D109FAB54 8435023585C04C0F 9BE9F292AC9AEB3A C1C3F80FA154C14D B88E2D5022E900E9 732B3679BB870898 7B3DE9F7588EA7D8 EE3F334475BFEEA9 780080BFDFA52506 FC5FCA9BAEAE1C8D 2FDF9EB374BDD1EB 745CD79BF3DB4404 DECCC836720CDF03 A8BAC8F4A8469C1A 8107F1AC44C876B2 162092EA85630732 4508E7502BAC44CE D236A7DFBF6B417C E343054D41FAC0F4 362F3DBC3BA0D80A AC96CE146DA78A14 7994388AFF92F6DF D62766B753F3CCB9 F0D4557662C705A4 AC34A3B3D21BF6BB EA864154E63ED82B 8D789826EBBE797D 034F60E29F0256C5 5F401F0BCEAF9420 E728C8F41712431B 95472B10D9F8E1A9 27797C170E34080C 44BC070B48D34F6E 58266E235C36C82B E728B00D72F3D8BB 118F4F8A82CFF5C4 3BA17F2BCFEEF02E 406619F5785A9996 1A0E09F468D22F93 7D32EC715A72B07D 3EECAA8F2DDDB75A ABCB83F608F0BDAA 03BAD8DF6AB2B3E8 AD68EF925379F200 F183E3BB7476B266 DA45E32111B009B0 C038778F56394365 77259236924F55DB 10B2F33BF13CBECC 0ED2A645926C041F 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 44032e95-069c-5ee2-b451-07b20c2634bd
  2 1c56f9a7-e46f-415a-9e3f-bb18a65d94bb
  3 021e0d07-8d43-1af5-bb21-3e94927bf421
  4 0733ac86-3325-7bfb-974f-cd7b8f82ef17
  5 132138c7-f852-45b9-8dd9-6c56bd368124
  6 d0285bfe-929e-473f-a782-0722ab142e03
  7 7d77f69d-7d56-076c-8057-6d0fb4d938a1
  8 6ae65cc6-aae4-081e-9b88-ff22e8c614a3
  9 f820621a-cead-415e-afb6-5f9ba3799491
 10 e6a82af7-0028-35be-bbd2-d027a023faab
 11 b22b8c87-9dfa-03b1-a237-f9d0f3d9df48
 12 468755bd-6fee-4871-9583-2ac2320cb401
 13 c64a29c7-9cf2-5104-9d40-9852dd31127f
 14 c831d8f2-7339-845f-92fb-7ca298815997
 15 bde04807-5afd-07a6-adac-c45df331c1b6
 16 c5dafbfb-1840-54f9-ba8e-316661436a53
 17 e503d7cb-6437-1386-af18-796d987bd381
 18 51681371-11f4-5ed3-a632-22e6da5f495b
 19 5b24d89d-d76e-068b-a5d9-433258cfcb9f
 20 b6958d68-bd3a-2ceb-8f15-2c7ac7301b3b
 21 5b7eafec-f748-2818-b08b-6419efc8ef7b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 541744004304580515022. Exactly this sequence comes out of new Random(643).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 20 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related