201207030335 vywq3

explained decrypted filler

3DES(name) ECB, 19 GUIDs, seed 625

Metadata

Post ID: vywq3
Title: 201207030335 → 2012-07-03 03:35 on A858's clock
Posted (UTC): 2012-07-03 07:33:45
Timezone: UTC−4 · title 03:35 against posted 07:33 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,232 hex characters · 616 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 19
Filler GUID seed: new Random(625).Next(9) ✓ verified
Run: Run 10 (seed 38,548,093) (seed)
Draw: 10 · predicted N = 19 ✓
Machine boot: 2012-07-02 09:51–10:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 4 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

C9E0BE32BCD040C0 7ADAEDDA77C6500D FE62D6AB07A4BD7B 00E717D51029233D 22E9A010A1544CE8 2A0AD2970D163CE9 613CCAEFD41DA2CA 307D7C121E994345 6CFEE7BFACDC4CCC 0A6DCE80ABBDA9FC AA7116DDBB87A488 12BB110EB4C56C22 53B8691F3B6B3182 0FEB85E6649FFBFF D95E30B9CC26E6C6 7AB8192B66D7F54D C7A47C01120B4C3C CFEF95CE55ED305C 7D2AC6401F63887D B867BE5FC900BCB3 0D9FF9D3740C9912 43DBFF7C9D376BF3 D78F76DA1BBBF65C 1443079DEEB62397 1802ED4A3489E156 1B5C482325030112 0E807135465A35C1 F980E62C72C3491C 5C023E20744ED58A AD1EE5B2481266A3 5517FB31C80C5B7E 9A4CD49EE6037E64 E3A86F7AB5F67666 D2E005CD33A1E977 0A87EF0C5F6BF4B5 37C10E7957C42FA2 CD7F47B8C3E715E9 D1FD6E23163F3FFD EEB1C77DC7B203BD 723B46AA07C4BE98 89077B0AABA7B7A7 185020F61F37F137 2DA0C5ED47BA3733 FCD3EF8976397A79 E28DC3B0795BE447 96D2F6A21C67BFB4 E1127FCD91A3B204 9E9875132E700181 3C9084EBD2753FBC B4B17AF3EA6991FB B3B97366F8596B12 6BD935B5EA00BC15 2EFF4EF8AB4EDD7F CBBDA51AB8053224 52A3254C6A2DF899 625BF77A318DCEC2 2554DED0875CF299 0A2814C6D32BEC22 51B9C6A27153533F C69DDC6391C27C24 7C784F1015205390 D590E9BF16C0880A 2654F6E8490AF3AF AFBFE383AC49B57D 870033FE756DEDB1 A6C5DA57EAC7A96B 7165472332233BDF 968774C6D25EE290 F97715FC72C1CEED 5015E20A44CCDBEA 666CD39FCF9EFCB9 025F421CC1B3B54E C521B2D9C8412CEF 3E19451F5E170302 E387146F88B7B445 B3ADC690E0621FC0 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,232 hex characters = 616 bytes = 77 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 19 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c6bb6111-7cbe-2ac7-ae19-2b14c7a7695c
  2 7d74e41a-907f-1017-be66-a33feb35fe88
  3 ffb00f75-df3d-549d-9751-af1b9ecde787
  4 24360010-a3fb-8af6-b508-8e659ebfc1ad
  5 6c66b1a4-99ea-3e48-b42a-a29f8ab1b169
  6 5bdf4b9a-e043-6aaa-b184-43465c7ae155
  7 78b32dc4-3e51-8b0d-82a4-07b0b986a2ea
  8 918df408-da3b-8658-8039-7f8761bd48ab
  9 db967e02-467d-2e6c-bab7-bdafbfd3a61d
 10 c6442849-c1e9-6818-a8ed-044fc9b4dbdc
 11 d726d3ba-70ba-6484-9cc6-ed07b76a5989
 12 b71b5ba5-58a5-35af-ae8d-07a6c2f08520
 13 bbac675d-f746-2a3e-90d0-5f8bc246509c
 14 bd66c249-5521-5433-9cf0-99b56a7b4cd1
 15 5f5d9efc-57b4-4115-9a98-9e7b932b877d
 16 08c3607f-7dee-3acc-8d70-a68d4c92b24e
 17 b3c9d020-ff2d-52b4-b418-ee4a3dbc21e8
 18 e6f2bb20-abaa-4736-8cc3-7659798aba62
 19 724f8597-5828-53aa-946a-cd12713ba992

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2158368826632543545. Exactly this sequence comes out of new Random(625).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 10 (seed 38,548,093): new Random(38548093), Next(8,64) per post. The RNG predicts N = 19; the post has N = 19 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-02 09:51–10:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related