201206271513 vpi8j

explained decrypted filler

3DES(name) ECB, 24 GUIDs, seed 256

Metadata

Post ID: vpi8j
Title: 201206271513 → 2012-06-27 15:13 on A858's clock
Posted (UTC): 2012-06-27 22:11:33
Timezone: UTC−7 · title 15:13 against posted 22:11 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,552 hex characters · 776 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 24
Filler GUID seed: new Random(256).Next(9) ✓ verified
Run: vpao3 (short)
Draw: 3 (assumed: numbered from the first post)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: short

From the post to its content

As posted (encrypted)

76E52D354337D046 EB7534B72FF1B471 DB0BE5F130440F99 1E5314E57888E44D 76008E07E2ABEB84 72562C700C156B58 E2D1DF7CFED93ABF C58465122243C67E 9E5054B37C446F65 531EAF8955A35745 D7673F8105B0AF5D C26C39CCBA3CDF96 EB510177249ABE63 681CE649E12144EC 757A5FF4266FE318 70C57392B4C3C637 4F2DEF8AFED0DD16 C23ED31BBA645FC3 EBFF6A340101947D 12D7AC349F13C488 8B994070818FC6A9 C0AC59800ED4252B 74382D5580D4AE2A 8AD01EAD5484B1CA B5686245BA9BF007 C878E1C421E83DE7 6EDDB34BBE61A67A DE5F71D0A8722849 A82168D89393F60E FF7C8F61D10F7887 A4B7FC8660A3A6D1 2696E204FAA2F8DD DF86F5EA67E1A2B7 AC39DB286063ED73 E3E75F86306514B7 6461ED5003881E3A 52ACE72E916E0305 66353833A35F71DC 3A486020B57592D0 C75431A2A4939037 279A6C8AA61B04E7 0AEC75079FE8160B D46897C9A39D05F2 036124612F476272 687DD4A6B1774756 9144D9B8EE8569AC 10FB8CA7B9BED29D 63B76FFB23EFA19C 1BB52B131484B2FD E6434D95E8B7EE15 F86C7CA3740D0016 33966F43E9AFC2D6 F304C721851708A8 18EA3C89C6042C0E 4A473710E7CF4EF4 AE3A8A2341E49ED5 B5854A60EB2F4AF8 6AFD2DBF11ED7742 6029D7CEBDB6F937 A93C4833CE0C3F41 1D84832DBA1FBBF8 AD05EE13062A9767 B951253B29C895ED CB5E9B4EA5CC0F2B 63AC39971AC0D933 996957E76A0771EB C75B4A92F780919B 4F5D841E24706194 DF4DD457621EADD6 12CBED75EF6C5C33 B28881DF5A067928 1954186EDD5889F7 230ADB802DE50FD7 A260589C77710739 FC97466DE26408A9 65B240A68A62912C 44A868996A819E2F 28FE9A55EE2F5530 46587FEBDDEE74D5 E65793AECF33CABC 88D98DD64F896B72 CEB700DFC3ACF68B 569AD77E3126FBCE 5E46B8AA6573B95F E5FECF2B1AFE0A56 02A3941EDCFDB656 535773F1E8F3ACB6 B14381D693DE6DB3 E81C38C2EAB97BF1 8EFB5F0342D2DFCE E55796B9FEEC90AD B7B19F4E2544DDFE 9165DA4E052FE3AA 6D42B84129E5E062 E636C68AD2E0703D 0CA34AB049ED2BC6 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ff21b017-6174-441f-9347-a505f8824be1
  2 5c409b47-06e0-8f34-b787-26433af40452
  3 ba097530-1ff6-61e3-9211-1bc3918e28fe
  4 e12b232c-7677-19c3-bf21-93ce4e58ff4c
  5 b716f0c1-7b33-74c0-9952-59e0388a7357
  6 9cd4516a-f101-22fc-a045-a3c15ec5ef8f
  7 a6e2cd40-688f-5dda-b593-e176cb21bf46
  8 15c4381e-89b5-7954-9c6d-e1eeb3f9fc02
  9 73eda4cb-1cff-53bb-a4c1-3145e93dced3
 10 7217d1c3-655d-6b85-8d4d-148d583a6c18
 11 0ca10200-e32b-8800-9295-58bf391aae28
 12 3471c874-9b2c-2c62-94bc-c85651220ad9
 13 bfb0b9c0-83b2-5842-9bc8-43df06c6d593
 14 098ca959-dc21-5702-81e2-5f6d50a913df
 15 46e7c94a-cf55-145f-94bf-75e218c2dd3b
 16 ad152d2e-fb5e-8a4d-8a29-b7793323bf22
 17 e1fed6ab-e4d9-4bfa-ad9e-16cd1ef8581e
 18 bf0aa646-dd0c-6904-a768-72f9aa3c12ae
 19 f291d454-5cb8-50a4-88de-106a01411f73
 20 315785d9-bd1e-3c09-9dab-7545146dab27
 21 e09f5e47-0ef1-71d7-bf98-a9b0e5724c4d
 22 88ee68ee-d5d4-58c6-b9d4-84426e4b8b35
 23 39f3e534-baf3-2458-8b61-41c0357af0d1
 24 fcc4af32-44f0-48cd-9177-86b9600738b6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 486172575682551846537524. Exactly this sequence comes out of new Random(256).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. Grouped in vpao3: 7 posts (40 bits) with no seed under any tested model: not Next(8,64) anywhere in 2^31, not run 8 with a new range, no fresh start on either June boot, N not from the GUID-list seed
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related