201206270612 vnigw

explained decrypted filler

3DES(name) ECB, 23 GUIDs, seed 851

Metadata

Post ID: vnigw
Title: 201206270612 → 2012-06-27 06:12 on A858's clock
Posted (UTC): 2012-06-26 22:10:58
Timezone: UTC+8 · title 06:12 against posted 22:10 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,488 hex characters · 744 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 23
Filler GUID seed: new Random(851).Next(9) ✓ verified
Run: Run 5 (seed 659,062,118) (seed)
Draw: 16 · predicted N = 23 ✓
Machine boot: F 2012-05-15 19:11–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

112C6A986B57F4EA ADC4407BFEAA1EB1 1ABC2E3979DA107F EAC3C56E8B32A301 D30F1C07B91CD94D F67E4E2C21EAEB15 2FBB8157DCD8385F 3EEBCC668D0F042D 799022D62254ACB6 1FAD0789EBC8E7DF 87B8644D1C54D2A6 CABAA523B6E3E196 88BCF3407FC39E0D 4C71D9C0F3FD19F7 393417B1C550CD44 97549A9A54EA0CDE 8F78FEC1647354D4 84C90D837E32B20B 0DDA6DBC6F8960EA 5208B886F97060D7 B54A718E6480F6C5 34B28C0801749D21 DA96BA95A581E8BE 6956D781F943ADE9 444CA723998D6494 3B97F347A5DCE531 F4CAB33B89EB796E B878805F6DCC161B 643DE5AB659ED0C3 116D5B112BA144D8 1DD01CBDE4287E9D 82757A62125F488B B43E012744DA39F2 ABA9BF663682E65D 21761724B15A7EDA 918FEFAD9B1E0972 C8CC76FAF9DC922C 150C8F500E8829A4 54FB058557A52CCE A0A600AFCFEDA394 F094C438532051FE EF7E9897186C734D 999BC144AC4868FD BD8929226BF3DA85 CC04E831E41F2E76 F06BB94506FABC4C 4E025B66DA1AF5C0 4A8315029B15A433 DC452818D8BCC57C 612BC33F4A81CA04 9A2E7D147D8CA42C D1FFD037596EEF06 C33E53B0FC847716 5F5AD0E0DA9FEA91 0755B9268BBC068A 6D6D461F4B533205 2064A33B0F3F1BB9 A62C6BA8C31BDAC6 1308207C0B4BD5E5 0FB89F04D1A4D2D2 DA2CE4F363C286F7 9B01E7271A03C755 3AEE6E6E93F0486D 83E4F74F78CC3623 27028A943D038C93 91511010DBF6272C 3271073EC7976091 502D368804D42892 AC0A306927BC7048 C07B584FE81F39FB 4ECA372B24C94548 914A5AEC1776292F 7B871A8025C79207 1FAA0FBC34C210E8 7F0D7657F73E4D6F 02D52E6AD79E573D E0C3A84C1D8EAD42 36F5ED60D2669621 A22542E5910B7E7D 9733CD21D171A70F F9C13F75B334E06B 9CCD6F05B925A695 49972BC10C883FD3 5FE347CCF9FE7ECC 0A328ABED045EFC7 5811F111AC922733 B3958C60BA34C363 6C1C7EAD383116C2 6B2C697073370C74 500E56EC519CAD5D ECFF4FF36AE68A1F 1BC60EB01536A350 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8444cec0-99f6-2966-b9ec-c79322a828ca
  2 5c2d28cc-d9db-4c09-87d9-d1bcbec74ee1
  3 710c7dd9-7a03-5834-92f3-df44ef79cecd
  4 1daa1dae-4dff-15b8-9d0d-e292249cc501
  5 e3eb9405-4676-3dc5-a96a-7d87e4a5db8d
  6 d47dc0c2-6b01-2a34-9502-8576da762a04
  7 d639e2ee-456a-134a-b862-d9cd1f504579
  8 0e77b0dd-87e0-3f56-96a9-726376c6c6c8
  9 7fcfafed-f64e-2bcd-b4f2-ded82692a6d4
 10 243f4b52-a53a-068f-945e-5173af74c881
 11 040c7b9a-3545-2d02-9fa0-a123f4ee2bd7
 12 5c2d3f65-2a89-760c-a949-2b1de343d8b9
 13 d8f0e9f3-1c4e-5bed-a8b6-963626da9f1d
 14 8b650a27-05d0-14db-bde9-e467bd673007
 15 01f5ee65-e77f-55b5-ae9e-1be47c36574d
 16 07aa13d0-4cc2-4893-8a62-737975857266
 17 18bb618d-6304-5e2b-ad74-886c813f2eb9
 18 8f71b8d6-aec5-5960-ba87-8ec6b0481e4f
 19 e4d1db3d-1c7d-683d-a422-1d57324e32ec
 20 384d2f4a-ef98-7801-a02c-a35652d6874c
 21 25ba180e-73b7-8d79-8f83-ba5e09cd3b70
 22 1d3c033e-4cbe-59cc-8853-17b9775bb0d0
 23 1b0e970b-3278-75f0-ae12-3b7d289da778

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 24513213202751545567857. Exactly this sequence comes out of new Random(851).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 16 of Run 5 (seed 659,062,118): new Random(659062118), Next(8,24) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related