201206261112 vn2mu

explained decrypted filler

3DES(name) ECB, 22 GUIDs, seed 324

Metadata

Post ID: vn2mu
Title: 201206261112 → 2012-06-26 11:12 on A858's clock
Posted (UTC): 2012-06-26 18:10:58
Timezone: UTC−7 · title 11:12 against posted 18:10 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(324).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 19 · predicted N = 22 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 4 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

2408ABCB032B9D78 CC285916F03D316E EA12CE05814F2EA3 035F0450C581982E 85745798F11C881F 264AF4D3A8D0DBA7 84B938208B323F0E 561C9A43744A5CD9 38175515BF4FC2F5 7DD7CAB5D0961248 5BD946C97445C88A E6A8B8B6CB1C8B47 3892C6EC19C80F6E 88A06EE4CB2AEB43 17130165F020A314 0FCADE96176C9FAE B8D24B99387C2D7E BA04F3ACBCBCEE57 3139D74A8A82EA55 046415D99C6F0FA2 6301CE14477578CE 913400A5DD43C371 1380A8255E71DE4A E09CF31D8CE70E62 563DE0D7F89298A7 54B30F153E2A2D7C 428D57E8C5C6C825 1D8F10D4B7EFBEDD DB204F129A8C5351 71463D668F3ADFC2 C24F9996E7118835 F20FC23EC72D5B05 3C243607CC90A37B 31F8B7FDD3337EDA EC2BBD131E8EA794 0EB886A91D406806 E61B60D79E74EF8C 2D11E0CC0E430B1D 704B406AF5326F78 1D54B1F0ABFFDB8A 6D7F1B545126335C 12F608130801C8E1 BE4EE12D1724EA6B CE8F378FB3C818AB B2410B5A23B0E82B 026252B51AB698CC 9F4CF5A47A744E2E CD997B8FC46469D3 EC2E58CA7B80111A 2A9F9B6AD0C045B8 7BA4976BFD034A5A BFFB8459A8873006 869DAF127484FD8D DDEB83D785338E99 3C3F0AE4056E62BC 8C49248D81FA5154 C32C5AA71A3CD90C D91C898363A6EF7F 82AB6E9022F990BC D16F482DA4BE0C09 01E6CB0AA5147DE2 326040AA4C8867DF 5197EE3781FC34D1 9356CA21420BEEA8 6403D8A893EF0646 F74ACC7F9572C1CF 6806B965ADDA1661 8D65B22BAD9EB477 0CC3AA6FCA4B6D70 7A4C459D899A2FDE 1C942A7FB069D3EC C99007850CF8037B EC1C0556297CFB97 691E0670D78F8E6C B69FECE75ECE961E C9AF0F0BC180B0A4 19312E3409F4EFFC BE3FCDBAFA9DF15F 5974EDE4C44CD7AE 6C5650C1E994BCE8 7CD245BCDF0DE1F9 486DBA77CBBA685B 76585E5B5E162129 BB17394F00E4CAFE 88215B48B12DB56C 7178E22290F32CEA 6EC700CCF071F0F8 29661829536F05D3 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6a13a5df-5a28-8cd8-a554-9d1f2759eeba
  2 ccf69e7f-48ba-7b70-9ce4-8b3458ba64e7
  3 add5be6d-088e-2c56-bf0e-9b50135aa92c
  4 03183191-d17f-654c-a075-8550841a5852
  5 615fe67f-4d90-4f21-9606-e410a4134ecb
  6 fd98b27b-8ff4-6add-9fe9-e50258894b94
  7 ce46715c-be43-045d-8509-7edcfc27ee32
  8 c7c7f453-5ea7-8d0d-bc2d-8ef8a8a8f177
  9 ccbb171d-47bd-0a07-8d18-c2e54a305b0c
 10 00e5b951-f048-6043-bd7b-81ed1fada76d
 11 a140cc5d-e623-8f49-91dc-a0e12910a39b
 12 8bfefd3c-59ef-3310-ac7b-142306c5cd62
 13 7aff8225-c5f2-3a4d-af79-bdc35dc2aef4
 14 d87aa9f5-5a54-092d-b586-11849a1ff0f5
 15 0be8d90c-3059-605b-8e65-1885c362e674
 16 2db9cf44-19d8-3172-8342-ca0d70c03751
 17 6ae2bb95-cc5f-0233-bef1-a12a26cc8e31
 18 40330937-2ced-71da-ba80-70713e68708e
 19 b50f144d-f2b4-4970-b9bb-f1c7077ae74c
 20 208ec7b4-91bc-6eac-b459-3e77c5d0dc70
 21 c4886300-2d5f-76a0-bfda-dcd257725849
 22 b0be4ab9-6100-3579-98e6-be006c82cadd

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8726460806833063074673. Exactly this sequence comes out of new Random(324).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 19 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related