201206261208 vn6ep

explained decrypted filler

3DES(name) ECB, 23 GUIDs, seed 449

Metadata

Post ID: vn6ep
Title: 201206261208 → 2012-06-26 12:08 on A858's clock
Posted (UTC): 2012-06-26 19:06:25
Timezone: UTC−7 · title 12:08 against posted 19:06 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,488 hex characters · 744 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 23
Filler GUID seed: new Random(449).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 69 · predicted N = 23 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

9071FD991D3090C6 D327C6DEE9169CF3 EFDB9C730BF9EA94 B03CD1F3F8346B60 FBE871494ABCF411 93DF338A7BF48A22 59CE870DA1E16FFD 1D247CE7BDB3A46B 0D362F7AAD838CC6 CD863379F5613477 5FCCD3050A021E09 10BA4BA48A47E672 33DDF8881DD3DD2F E6A898E81B49B83A 54531468B269B509 4D586EC384EB6261 79F4C0CD5CD7EE55 23C3DBBEF57838B0 6B60E467A01683CF B8056D5208D5A3BF 52592F98963EE14E 6CAD9FD92B1BD759 7C3AE5604084A3E5 AA72355192D28569 A01D6AD3FE96C1E2 634EEC214915F3E1 42375C9437364EDF FC6B2A1E9EF2CC22 3535F42130A0477A D74A81FC0FAA8094 4060584C4354EF54 CC344F7CF6F7B206 CF1FADC937F83E26 4B181ADF949ECDD8 51D61331F4E9D93F C9F59BCB05DFBAD5 0F524A9548E19831 DD71A4E2C1F655A3 705F17534DCC54A4 E6C65B5D61DC6C8C F6B56993DB613BD8 00CEF446D0751A58 2174E5A378E74DC2 7BBA1429DDC6D19F 14DF40844213D168 3258D03939D9A015 400F78ADABC2E4A5 6A338FFDF7E4B651 84C48532A8A0AF49 CA844AEC7222EEE4 96F58A37F51BB807 8A70D11B0A169038 CF39F6ED87379599 EABD9F13E3EE9E53 0679CE537A771216 7FF62751D73BF94C D15A43BF53A06E0F 43AB03CCEEF55FEF 19E4806545C67C28 B5EAF8A0F230C3B3 7A3F0425C9611685 83C7D57C9A53A11A 33A60054A3642744 641B01EE23C27C50 FEF6A0D18D2108DF 1B76280F3DD51D92 50954AD75A5485A0 D81552B15EDB2847 0942B6EE6B69B825 122574C518D2D316 93CAA927FF03690E A3E749EA11C09A04 D1E65A76A98D4A73 A1D6F1A869F14C69 0D228822BBB0276C 41ED882482F8F099 9AD6E71302CA9782 1871D9D8949AE06C 8C3CC7E8DA4C513B 098B3C320883D95E 1B7572CC6A39A6A6 E1F8F3F01C925865 17B854C49D253C9E 52E38A537C323FAE 9CD88E086BFABB5E 5E704F17A970FC4B 4B67E5DEF4C31FAC 0D537118FB14728B 1A7D64B8A49DE17E D2A9B7F6EB3C12D5 F75FFEE86464573E D16A17C872E86946 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 62447cd5-20c9-2bf7-a70b-4b6929321dee
  2 e8604e82-bae9-5610-9d49-c7e6654e29dc
  3 c284c9fb-57f5-5622-819e-bf100e43020b
  4 a5fc9b4f-16c9-3813-8e32-466fe8a6cc46
  5 42ba5fea-526a-870f-835c-763ccc78958a
  6 09e5c7f6-faf6-887e-8ec0-35990a1ec6c2
  7 345a8306-8bdf-0f35-acfd-4f059321fcf1
  8 9a9d3809-0076-66db-8b7e-6f402669b04e
  9 277dac96-c925-48db-ad4a-e975047977a5
 10 a2417fd5-b2e7-71f1-b003-bda6342169f3
 11 169d31c3-36b5-0830-924c-09da81bf3cfc
 12 f40c837e-adfb-01fd-90d0-7967c134d76d
 13 2ebe54ce-a2fa-28ff-abc8-64cdf4881ff0
 14 67f5bc61-70e5-0747-9c4a-bf00e6bf76b8
 15 bf50dbdd-29fa-2941-a3b4-2764459f1616
 16 6d08a592-3a64-3607-9a0a-bf8e37b17bdb
 17 8171900c-b977-5e60-8f50-84ac62465fe8
 18 c39dfa5b-efac-313f-8104-cf7e8d014637
 19 144267e0-dfcd-7bd2-bbb0-a2945974e9e5
 20 0ad1acb6-a606-1a80-bd42-f85c80d35c19
 21 dbab5caa-25ed-412a-aa2f-8668f9cbb179
 22 d6079b53-e7f2-0fa7-bc74-5bf239a0afca
 23 be09a209-8e49-728c-806c-50ef8026fcb9

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 25538806470020235371407. Exactly this sequence comes out of new Random(449).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 69 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related