201206261111 vn2j5

explained decrypted filler

seed 390

Metadata

Post ID: vn2j5
Title: 201206261111 → 2012-06-26 11:11 on A858's clock
Posted (UTC): 2012-06-26 18:09:22
Timezone: UTC−7 · title 11:11 against posted 18:09 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 11
Filler GUID seed: new Random(390).Next(9) ✓ verified
Run: Run 3 (seed 1,063,142,882) (seed)
Draw: 18 · predicted N = 11 ✓
Machine boot: 2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

F4D592F9DC8DC608 3363B8DD71469DBA 1291EBA910876F41 4AC75791842711B1 6BA8707A00EFB8EC 3DF5A039F9B17217 5760BEBD9AA70579 2154A6D5DE07BC07 77C8ED2CB46FE32D 719C67D5B9B1FC45 B0E7E38481A5BB08 319EEAE981F3A71D 18ED3D54BF6E8320 FE51AB3A8BE6D519 61581D2F6825D052 3AC1142A74FBEBF5 C7DE30BBDC7E48D2 80261FC47315F1A2 ABB8782A2DF9200A 4D1C6844E402918F F0C106E21EFEF7D4 A5AB55E2A9608D45 3C97758469935A15 0E8A0EB8B82B5DAA 18796D56C7DB32C2 DD1F0485C7B585CB 219C94DB7F6C9BBB 945D2AFF9ACE2AFF 5B9D350C6FB235A1 A331277C3CAC4BC3 7269786D1D8E6FB2 4F026872CBD43EA7 4724DE966DFA29F0 62998BD94B2345C8 8815F9C97BEFEE3D 7A871A1AB5C11351 0B9E7E6301629A03 21E82084AAB05B5E 2F878228CFF0B833 6BC8EC428B6982B7 0C60C66008BAE45B CA45B5CF4EA195C4 864F9E1AAA2501D2 50C393B0238113FC 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 50b08d68-a772-4b20-83ab-a2ffd70db7ac
  2 fe3ccceb-81f5-2d28-b89c-e35cc2ab7124
  3 f714b4aa-783a-32b8-88aa-74fb338fb354
  4 84b9bea8-24c9-7453-aa38-6252f7b3d790
  5 fa5b0064-37f9-2be3-87ab-6d4c79a115eb
  6 53ef7fd4-a316-340e-a525-17793f120c63
  7 ac730b17-0d93-5dcd-838f-a80ca1a8258f
  8 dfe17afc-cac9-0c72-9d99-a99e2c629481
  9 113916a5-afb9-2ba6-9801-4236b7bbbd0a
 10 a8032d96-6523-007a-8bb4-5dba7e950764
 11 287d7e8e-103d-55fd-a727-2e826d00dd97

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 42372350205. Exactly this sequence comes out of new Random(390).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 18 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related