201206261050 vn125

explained decrypted filler

seed 279

Metadata

Post ID: vn125
Title: 201206261050 → 2012-06-26 10:50 on A858's clock
Posted (UTC): 2012-06-26 17:48:35
Timezone: UTC−7 · title 10:50 against posted 17:48 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 13
Filler GUID seed: new Random(279).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 5 · predicted N = 13 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 9 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

E225FEAE4AA7DA8B ADF2CB03C433FF15 589173FB4CA8F8EB A659844EEC74EEB7 ED26012359BE8C77 D568A67F8F2E5753 D68D6C4725A19AE2 580CA1DA652E1BF9 6043D8D51C51B4DC BF8CC9759E656D50 0BDE5A412EA7FB5F 3F9A8025DF97C62F 41FC19FE04B72F48 41C89484BEF3D00B C2B1E794F5BE2D4E DEB16BEEFB6BADD8 4901F523674DFF16 AD0A7EDA0CE5D912 6B78812C86C59F2F F7E12FF090A63EFF 90CDF777B182B310 CB57FEE22CD11E34 745FAED6B77EA6C5 B09ABEF03AFD95E8 37E42A4E9049F894 E3444910EF6287B7 65ACC120FDE61E34 33950D4EEC931E9C 23D83C4B6969C811 F0DCFE1886BAE993 DDA5688EC19910E7 FDC03D5A72D5C38D 3FC6140E927EFD1C 0513EB2097CA49DF 22DA8E69A25835CB B228AE290D9D6304 31EFEFE7E48A4A3F D41836B52D4EA420 73A078F611BC6372 6A8D5112E73D94DA CCEB38382E71D7BF ACCEB589AB680B07 2D21C323595BE77B 3E9CCB3275788E48 16B904D238E27A1F E37B571BD1372D43 7953244A7E64A00A B60299B77ECB4726 69478458EC63C59A 5CE39E85838A1DED 8480403CD015B9E4 408EB12774C2C169 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e591e970-c3ed-4e0c-89d2-85b9619db59d
  2 48413f93-1917-6656-9930-7b873be3c9e4
  3 e53a4a0e-e8bb-74b8-bf72-fe47bc52ea84
  4 bd96761d-f8a6-0d09-b11e-97848eaff60f
  5 5da23804-9427-1eaf-9781-1003897073c0
  6 763deb14-dd04-396b-a547-66ae12e77856
  7 84301a4f-7d5a-80bf-b626-2092052c7490
  8 30fab896-fea6-36fc-a44c-04ddc2769198
  9 6b123331-a185-4d95-b81a-01c20661c6df
 10 fb16c7ea-6bbb-199d-b7d1-aa19c2d1bc47
 11 1e5af3fd-bb27-7ab4-92a3-1fc57aa36eba
 12 2689bc5c-3834-2e9a-afe7-e0e94ff7106c
 13 31abecb8-7018-3341-824e-39588dd08805

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4670138341723. Exactly this sequence comes out of new Random(279).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 5 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related