201206270805 vnozx

explained decrypted filler

seed 10

Metadata

Post ID: vnozx
Title: 201206270805 → 2012-06-27 08:05 on A858's clock
Posted (UTC): 2012-06-27 00:03:44
Timezone: UTC+8 · title 08:05 against posted 00:03 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 10
Filler GUID seed: new Random(10).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 10 · predicted N = 10 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

13155C6A7CB862F1 03E9E96DA5643CBA B88B6F1A758DBF52 469F6D224D0BEC90 5EF0207C30661847 7AB9D0EB7F4C3F51 AEB4E1F480AE300A 3C62A7E8B7969F66 B6976E7A16F5B0E9 DA98AE130032912F 3AD342A84F6D56D0 E3E821964EEEADBA EB9AF4DBA9EACDDC 9E27429D2F9E187F CCD4D591DADF9B85 AC76C8AA545338C7 78BF4E90C8E9BE7C F614AAD31B2A8FCC C9489D292D3C39C7 D5C0A72ABE64611F 1A4734C3D51A8CF0 CD9485A2CEA5A307 AE100E68E4071D64 53E2C69FC612C863 BB769BEF53DCA2CD 23DDDABEFC0A1908 FDE6463DA2E619E2 DD2EF2D119D7F285 BD86A1F5866DB330 6844C3D1B949A260 15A03952AD251951 F2573CA897D53BCA FE212927A7D42FF8 192E84D40441112B 9C03952A2B47524D 6DCB399474805A7E 17C3816CA1D50F49 4077E6F20D2EA6D7 A3D7180C32A48F80 0CD7D5A2D9B19B80 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 158595d9-011f-8883-8f49-34e197518d17
  2 2fed4953-1dd3-6a7a-96cc-c0ff02ad1712
  3 005669ea-583f-6b1e-b8e8-f85d3a0d9250
  4 aa6c1b69-9c7b-67a1-b1d9-6dfb4def5055
  5 e02e1b2f-2fe8-60b0-a6a6-edff56add2ac
  6 139506e5-1889-2082-98b1-83b8a969ac85
  7 b0f80a5e-cb42-33f0-a754-132049ad2f02
  8 d6c95cdf-d909-4b84-b048-acb2591debff
  9 cfe37a42-e321-1808-9919-1b79f8f1a745
 10 52da8dd0-6b0e-8948-b296-bdac5a6f4c01

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8666623418. Exactly this sequence comes out of new Random(10).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related