201206261213 vn6qr

explained decrypted filler

3DES(name) ECB, 22 GUIDs, seed 259

Metadata

Post ID: vn6qr
Title: 201206261213 → 2012-06-26 12:13 on A858's clock
Posted (UTC): 2012-06-26 19:11:27
Timezone: UTC−7 · title 12:13 against posted 19:11 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(259).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 70 · predicted N = 22 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

6437A4A4C235C738 7C12464370DF43E8 F30B603B898764C3 09CC033194E6F95E D6CC6AB2BCC03D70 C8433519557AFBC5 7BFB42E623454C4C FD0846B3A551E65A 9A4578E15471399E 917423B99D83264B 87033092CDF1869A 781EF5D84095CC78 B3ED0CC7993DBC17 FD184A4429D97A11 D4429E86A853BAA6 E32610E1A679E50E 8A07934BA51FDA56 092A9BF1A81EB0A5 1E744FEC3187864A 8AA082AFF4927FF7 09153005CF801D12 15A740E10D8ECE58 C15FDA219409909E 89EBAE9FA3B8791E 782179CF68352342 658815AD83594A7C 6368EB311B380C03 53E7C3CE71C3096E 141F38E69568F522 AF690C01208CD38F 613A0ECA437F8ACA E26A97B5BC1B8D8A 9421E2670CD8A141 AF0DFA744871AA29 72870BFB0B948065 8389AAC2BC609FDD 2A2BAC4E316C3406 3B2F941A444C9F83 570E7D0C4BD9252B 4B3FCF1503EA5B55 09A7D2D995B64BE5 C2CE95ED79FDBD87 F3325AA00E8AD9EC FDA3E4FDE7678633 682C17FBC0B3D259 6141DEC80CBB7567 05CAA771D84A9286 78476D080D78A53B 611FF52BDFAFF511 FFDF0298BAC5140B 3558EEAEC8E9D80A 0E80B2BBDF6E9E35 BC7AC3D5DA7185C7 E683595F754FDD65 6A69AA694BABEABE B649D0BCD25AA115 73D21860EC302C60 0E5E23796BA9EB8D F659E03B4A9930B7 802C94696D359A64 9B99557357DF39CF 0284AF4A14C562ED 52A7B12CE519AFC8 E8C96BC7BF0A7428 1C31C577F2C7BF66 DD48C2354327BC54 EBEB3004E74FCD25 58A012E158E6297B F5A504C6A43716D1 B2FDF8368B03F1B6 5F2F4635540D4066 E4784F7702908ADA AA065467581E1C09 A3FA2F9127D4D91E EF0A5BA1032100F9 A2793C119C6E74A4 ED8A8C56939A4551 E2291EDC86DE3410 9E241A7F8EB1207D 57160EF4E0D57C65 C1EB7EA6E34EBE9D 6A2461A92E6EFF2E 89AEB5302D69E86D 6A4EDA9260972E74 7035822FB2870F3A 47A6A494B11C9EB8 BB92BFAB364904ED BA65197D39F44D57 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 10245015-1c0d-0abd-82d3-bf84f5a4de3e
  2 32c791a1-85e2-7094-8c18-a7185160e8b8
  3 258141d8-ea98-7ca2-baaa-6fd8acd8053e
  4 24b4734e-1750-7281-ab78-cd38114ab170
  5 ab9b1fc5-d270-12ff-b6e2-f94617bdb82d
  6 e779dfad-d308-85e3-9445-a3de70502fa9
  7 aec1eb91-371e-8998-bb47-d642351a6e4c
  8 83f8325e-14ed-334f-a2da-f7a6ddc1f0ec
  9 fba277a2-bcf8-07dd-9a23-7c78b27e816f
 10 ac1f9228-42b8-7b8d-a2f0-ef61021c9d66
 11 1dc35c17-b7f2-0e7d-b915-3cdeb8fe80f2
 12 b8716603-49e1-6058-b44f-f48123a0dcfd
 13 878e80e1-fc5a-6bb4-aecd-0f50af6230f8
 14 b09328f2-fc69-1a82-9c6b-29ac69eca044
 15 f86ef273-3efa-29ce-9a41-3156fe3a7ad4
 16 1dee6210-4fa9-7d95-b5d2-588efe37e8ab
 17 c2d0264a-a3fc-6cf8-aad1-32d308cc026f
 18 164446a2-d25a-57f3-90ad-1a94ebdba7eb
 19 e5625b12-8bd5-6458-ab7c-473d45d73bd5
 20 cc16db8b-0f50-548e-a39a-895070914151
 21 a21a830e-7d3c-2950-8a17-9b55cfca11c3
 22 c44a64a6-9dee-3eae-bc55-3ce1e863a420

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0777188307066127656523. Exactly this sequence comes out of new Random(259).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 70 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related