201206271529 vp7xw

explained decrypted filler

3DES(name) ECB, 23 GUIDs, seed 231

Metadata

Post ID: vp7xw
Title: 201206271529 → 2012-06-27 15:29 on A858's clock
Posted (UTC): 2012-06-27 19:27:32
Timezone: UTC−4 · title 15:29 against posted 19:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,488 hex characters · 744 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 23
Filler GUID seed: new Random(231).Next(9) ✓ verified
Run: Run 8 (seed 593,707,075) (seed)
Draw: 12 · predicted N = 23 ✓
Machine boot: F 2012-05-15 18:59–19:19 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

DF8991EAB5C12C9D 23D76A89A6B23E0D EE2728D3FDF97F5C 9351E99A075C538C F20767494FA914A3 3C1662DCD4B69700 A37603F4BB61C114 190E6D6FBAB358D9 C07331DC3D98FC98 2CB2BC2D7D344232 3580C33DCEDB176E 40764DCD580948AE C539F92A15457F1B F06797225C8B721E EF475E366EAE1E7A 081B35BCB2FF8BC2 D9F804B0189B0CE0 FA9C459B0925C8DE 9E755A60E43C3FAF 19FB01D8F94A27AA 9A2F64FC74F42A75 E18D0551C1603338 18842E0F655C958D 696D527804F78CE4 18D188E426296EA2 4308463522A9248B BFF4424C9F83A4C9 863BA0C1B7BA4432 3F66D969BB116577 E2E54C658148658C E2DF95E3D5E4D209 DD70812E4ECBFAA6 5F81B539A5D675FD 852D5568B6676895 45FDF82158E3E4A3 32A6F2502C8B74E1 3BD3826D5B93D9B0 9BD03D282B3D6096 B325AAC2B5B5390C C94DF3B403706738 9AB8AADA8EED131F AC16E2325EC14596 D9EB9EC65529FDA3 FFAE6485388CADF1 03245D9340A07216 26A64778FDE230B3 3128E66D59E47868 AEDD2509EF413DA8 18C782882BC048F6 89C42914093D7EA6 1F3FBFC476B55C51 A4D02B52A81A104F C82DF0C237E1D77D D75D622461EE571C 0351A8D13FC95C0C AD89E6A82A55D4ED AB4F37CDE279ABE0 1D6E7B291569D336 DC4551A614E3B7E6 ED3FF87EDFA610C8 E3AEB958FF5E6994 C157F10528725B68 F3CB71A0CC3A5F5C 9C3BCFDF01B3DFEF D7CA79D81DC9E83E 5AE2EF6DF0F82759 DD61F12238B047A6 280E4856436ACC02 3BFACD29655D7EEA C4FA1EB7718D04B2 2D4ABC2749FB7DAE C555CC15A9F31B3A FEC982237BFF1B4E E446A17D70F08F8C FA0189AB64E55D37 B3B84A3DAF53797C 81B78CA346B38A2C 483699DC56B816FE C4FAC525CFB58717 A23FCCBF34DE3B3E 52542CDFE66A18CA 14A0703489F729B3 2F27AC3A5AD26C59 52C67F52E0609F85 0BD879EEC3D6AF3C B978176FB31A752D BDB3B66EB77F0920 B87D85267195678E C55C7188CCDF879F 584E92D677122C9A C7BE2CD9AD398A7E BE44B20A64F7C95F 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fba1eed4-1b2a-33a0-8a50-bb7194e4d495
  2 a497e5d0-0e3e-5d4f-8379-417914007c84
  3 82cbafdf-5fb2-2bf7-befb-fb96ee237266
  4 978c3c5f-2beb-7283-a184-61724406d85e
  5 2db1ccc2-d215-4402-88c1-9afe2e1f5725
  6 5f15c3c1-9cd1-3589-baa3-7e3542b5bd4f
  7 7af797c4-ef83-3aa0-a2b5-0bdad8154529
  8 2e3350a7-73b5-2623-ba02-79a407c79417
  9 d572c643-6d78-5412-9b6c-b793f2fe762b
 10 1a0ed788-42e6-4109-b731-ce6a08789bf0
 11 6cb33188-34c5-4dc6-8c31-3331869dbb65
 12 63a4febf-b004-71a2-bc72-ff4012f5d978
 13 2c3c132a-a5a7-3a3e-852a-fcc586488c40
 14 6c17ba32-c269-5ddb-9b62-cb761b132b71
 15 56642262-3884-6670-9975-7310f0abff9f
 16 b4532686-fe63-2ed2-b1cd-754155e8ced9
 17 1e5ffe4b-f734-8da6-9ceb-5124a910b7c2
 18 e4ab29e6-7360-1429-9262-cc454eb687b1
 19 fc627897-7ab3-8b04-a7be-eb657847e0ca
 20 c241194e-7786-60a9-b6f7-b78d84842e02
 21 98796e3e-17e7-4553-992a-ab4b91e55130
 22 d39ed533-e7b5-4163-87b1-9b144fb37a94
 23 ba838cf3-8890-0ba3-8601-bc199c0b51d6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 35274332544735628186440. Exactly this sequence comes out of new Random(231).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 12 of Run 8 (seed 593,707,075): new Random(593707075), Next(8,24) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:59–19:19).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related