201206271429 vp3yn

explained decrypted filler

3DES(name) ECB, 21 GUIDs, seed 59

Metadata

Post ID: vp3yn
Title: 201206271429 → 2012-06-27 14:29 on A858's clock
Posted (UTC): 2012-06-27 18:27:28
Timezone: UTC−4 · title 14:29 against posted 18:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(59).Next(9) ✓ verified
Run: Run 8 (seed 593,707,075) (seed)
Draw: 9 · predicted N = 21 ✓
Machine boot: F 2012-05-15 18:59–19:19 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

18A8535C9A4EFD66 42AF0B9D42B2FCC7 DAF1D3D0C31005F1 F136C1F726CA3F00 34E3F6196B870D07 192CA575EEC4E4EE 7E2EBBA5132EE38E 39DB7AD8A0BD87EC 98141743ED1DA459 9FCF72DCFF7A55DB 43671A50A16BE5A2 006DEC7A0746B78A 5FDED259E51A3480 8975CB395B9EDC01 006CE2741FA4E3DE 4C2F3FAA4B73C530 13EDAF2AE7340B0A 982424E23389B593 4BEAC1EBFB9D5A73 9D974783C15B1CD4 1E4EC1517EB3DB15 B3361B7B0D12276C C40E9D1E3D55BE4B B329BF3E50BB1CF7 7468FB21D40AF37E E670B0921ED64BD6 309067D54831805A 28F3C5A70535CC00 794861D9C79A1D99 732DD96702260709 59EB626F915F9F26 89F56636A8C699C6 2E543040BE92B63A 5885BED3BEE7A068 384DCA64B17BC59A 1D09FE8748B808C5 FF5C9CB738D6F446 50DA1EBA35099E3B 32A9E1700FFE0EEC C9E8E9FD88C6A3F6 51895FF98552703D 6195090284AE43FF 1428D6174F93AAB5 82C98203D665CA79 33623B6D76E9B716 F0339F90228A85BE F0B05328C5590940 4C1626A51B534E51 FA3032E237FDC132 16FB83F472109E70 854C3C5294E10903 E2A2A544E31AED6D D54E2D0D2ECECD3E 84CBE0E0C5E8AE95 1F00B082E92BC6B2 6E9223503306E81E ED7077F0673D98AD DF35E87F3625EA23 AC18FF778BD54AB5 3D15B7C10438A98C E7CA1B8A5239AF74 1C73C622220925E7 90860EB3DD7CA4A5 8C7EA765F8DA7C68 0973FAB0D2C5F83B AB3A5C36C0D29A4B 892964D8D9A05D91 9184455560FEA4C4 E26496960E2D1CBF 01C19F62BCAF546E C788EE6D6EC468D3 01C31829CFAAA7AA 41942FBCD531B64D 1BF875AAFB8C173E C3F054B382DDF8B1 44C460ADAFC4206A B5E995CA078F665C D9E80231B151DF9B C6E9D67EB65F5829 C230201DF1D534ED 8E17E48D32B2A0DA EEDF8FFE99146CE6 1FCDE8FCD59BCCCA 191CDE6BAFC3D3ED 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a5ae0cf2-ad96-4f6e-9c12-c555e0753da3
  2 1402973a-4011-1d6b-8f0e-49ead869fc8c
  3 06b33d24-a9d2-0a15-a482-70299334fb72
  4 e89a12d6-34e8-16d1-a718-e56ed60cf8d9
  5 e96cf823-c655-7f73-8a3f-6205c3d5dba0
  6 99b97806-b486-1dc7-be7e-92b8a9eee047
  7 f1977d14-26b9-3604-98da-be8cd6b5d7e7
  8 2a9b61a9-4fe9-02ee-bf5d-a1ee82b22ebb
  9 d2544ca5-9cec-27ce-99f6-9512f20418c1
 10 812a9ca1-7df1-043e-b724-b6f5bc14b858
 11 3513c910-43f1-6b25-b205-6beac5c9294a
 12 d771876a-2a98-4178-b50a-0d065a66b767
 13 bca343a6-61f4-1e6b-ac52-e1410b6213a1
 14 f94271e5-249d-1125-ad49-67ac39efaae0
 15 4f8634c2-b02b-2c0d-bacb-5e95b6a9a3b9
 16 b3227138-5fae-72b6-ad16-8f08e39f6d87
 17 63965e72-441a-5e15-b228-1bf942359bd3
 18 8a64c243-e1a7-5a15-817b-812ae6f5f130
 19 29b98607-aa58-2701-a8a3-3cc4a78f80a9
 20 e1a34d20-bb3a-17a2-a0c9-083a8f8485c7
 21 74ac58f2-df53-56b7-9f13-e8f199aac43a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 410171302064112755215. Exactly this sequence comes out of new Random(59).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 9 of Run 8 (seed 593,707,075): new Random(593707075), Next(8,24) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:59–19:19).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related