201206271015 vnwfs

explained decrypted filler

3DES(name) ECB, 20 GUIDs, seed 23

Metadata

Post ID: vnwfs
Title: 201206271015 → 2012-06-27 10:15 on A858's clock
Posted (UTC): 2012-06-27 02:14:03
Timezone: UTC+8 · title 10:15 against posted 02:14 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 20
Filler GUID seed: new Random(23).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 23 · predicted N = 20 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

37279CF3487F2AD7 64C9E1BCE90D91A9 C6C9DC0360CBF1D3 1806E75F540E06BD 265054D2B3387846 ECB6B6F9C18FDB89 591A479F060653C7 122D0377253FB300 FDE931C27353EFCB 7629E995F34BE9CB 09E2CACAFDB31BB0 316D73797F9AA4C5 1F408D0C0C6B62A6 1B79AE07E0F452E9 9F35A04673AD31D5 86B9C7DB5E6F26AE 4AA7E48B4513264D 7DF25B83CB4BF2D2 3B67C7ECC0EB607A D562F4F247E90D03 125206E146CAEAE2 D114987163E060E1 C69847BC62543D19 B6B084E90CE55A8E EF7F4F5E4E82B9ED 36EF8D6A40CB260D DB3F648CBBC587D2 750E02AC58D5FAA3 1230F8F24B0CB3B1 30ECEC1989D3EA9C 0D933381D78EF270 B06BDF793AE06F6F 6F608BF020EA94EC 77DABC7C09758884 03A7A6E4617556CA 693F012A88D885B6 F42561F67F90E5F4 403B1098D4B2C785 89093476815739B0 9DD2638448B6EB06 B91E0E36F3EA9C5D 3357D453F1DA7F94 9474FD315C9E453F E530D78BE24D1F13 A7B134A3A2AA3C54 C1CE4D008CE871A2 2EE5DBE0B094CA8D 312B82C3BA736406 34310583990ECF53 E50B16BEA51419F8 9389AF3E47CA60F7 449EFE7C338A0A0A 9B097EC0C0FB06BB 2408FB2D7B3387FF 366BE96A3532FF07 5BD94120A5C2171B A20E841327D9022C B33F026F9E93C5A8 E2F97845FDA36A96 34274AFA67A7DA5F 5FC3B368330217A5 AC1D66534E92C70D 021FA07447F74E74 87C3F3F427E2BF2C 08C55C05043F1398 72C3A3690CFE406E F0E8E6E2010765AE DFC5C1E4FB685FC1 4CD1142413F502CD E1E6158F117EA97B F5D11AFE86E5876E 13D8A65BE4DD7769 D4B52000181AED18 FA5D2695EBCB5A61 A95B5B7DB8B410F6 A9758400D621E3AE 244B99E5F4E980DA 2B7034611735B79D A041672A30F2FD3C FE7C21CDD79E46F1 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 bc81f165-67bc-6b98-bd75-a46e46771afb
  2 20542a28-4b91-5166-8cda-7788d93debff
  3 483f9c11-315f-7206-a268-205d82e6dc6f
  4 3d94bb35-5ff1-4e33-8dfb-62d8ddbf01f6
  5 5cb90041-697e-58d3-97f9-fac1abfe59c0
  6 ac4bf3cf-c214-5281-a408-f7ac28ee4f86
  7 17e0dc15-53ec-1ad6-bb0f-284913bb1807
  8 f770765a-361b-8089-a8e3-0693e9ba1278
  9 232d05b7-51a8-7bd0-b0a9-4751a0c7de45
 10 f9952aa3-9517-692d-9bc4-20192819cbcf
 11 54da7652-89fc-23e4-bd2e-80173d93c5ac
 12 bf5b69d7-9b51-3c55-ab4d-84b325c6fb86
 13 d7a0120c-9cca-387f-82fa-b205aefead17
 14 add1b577-10d5-3a99-919f-44a4790b5b78
 15 e3cec3f3-156a-07a4-88ba-6200cc3a8de0
 16 8b17a101-9b73-3289-a025-00c942cd00ad
 17 316d34b4-687b-4fd5-9d2b-0f75f8466294
 18 5ebed8e6-f34e-2166-887d-bb389454354b
 19 7939cffb-db22-2ed5-b71b-749d29026e81
 20 50a79340-9bc1-1ed5-ac83-03133ac291b3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 65745518762333034221. Exactly this sequence comes out of new Random(23).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 23 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related