201206260957 vmxo9

explained decrypted filler

seed 516

Metadata

Post ID: vmxo9
Title: 201206260957 → 2012-06-26 09:57 on A858's clock
Posted (UTC): 2012-06-26 16:55:45
Timezone: UTC−7 · title 09:57 against posted 16:55 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 11
Filler GUID seed: new Random(516).Next(9) ✓ verified
Run: Run 2 (seed 1,054,905,639) (seed)
Draw: 19 · predicted N = 11 ✓
Machine boot: 2012-06-14 10:26–10:31 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

5D9C3792005317AB 8EEB56120735133A 94209C1DA6639266 26E6738E59DDFAA1 B6AF58A56938CE48 8533C14FE222B218 D330797423BADB94 2E52BD7A0C590D6B 7B8A0978A7C4056F E4A3FD8BCC13BEB2 793C16B026D0CD2B FCACC6FE318AC121 C61C88C3AE63E4B1 71DA65FF88B44789 FC04DF7B769D4A66 EEC79648BFD38548 C7C354ADD4CC3E15 342034E05DD87947 05ACB3BD97C8BE1F D34A5C3A30BAAD0A 510DBC89F062F538 8FF194D83DD19F43 699399B8DBE00B75 D5D49DF56CBDF912 71CF6EDA316243F2 B7CD044E32B5E83C 0DA716C27430951A 57E98D00609C98C1 33CD04C7785FA524 311BBEEB2400A76B 37EEBA86D1CD022D 21D908D80C8DE6A6 8C66ED0A9E6B35C3 8C24C75C647DFE51 F0CA39D6AEC8E42C 9BFEC5B62A4823B6 6ACD868F0FB04BB7 4480B5997F06F966 CD3A3A05CFB12532 132444849F039D94 76110F86A4ABBA12 9607A6F8FDB8B267 F30F7997E50DC1A4 D6657A89F1273007 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 04dc475e-83fc-2dc3-94e6-5939285fe7d2
  2 fbcbd889-dc68-1521-8c62-00f58583fd7b
  3 c0caf809-26bd-4ec9-ad23-4b4d2fb029ec
  4 c531c675-45ba-6d98-b427-f8054607c24f
  5 dea14404-bdec-1c5c-b3c8-e107ebdf3109
  6 20ab700d-a3a0-4702-9dc0-e607903fd87e
  7 1d291400-3384-0f8d-89f1-5defb78a7b35
  8 60e29b76-8ce8-2546-ac29-7682ec00225e
  9 7931c457-29e1-7787-bae7-79661302ae0e
 10 41200eb6-6e25-454d-bedc-2e78733f8379
 11 b18a187e-ae7a-4fa4-9e3b-2ebfea39b468

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 21461402744. Exactly this sequence comes out of new Random(516).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 19 of Run 2 (seed 1,054,905,639): new Random(1054905639), Next(8,24) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:26–10:31).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related