201206271236 vo4da

explained decrypted filler

seed 939

Metadata

Post ID: vo4da
Title: 201206271236 → 2012-06-27 12:36 on A858's clock
Posted (UTC): 2012-06-27 04:34:20
Timezone: UTC+8 · title 12:36 against posted 04:34 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 20
Filler GUID seed: new Random(939).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 37 · predicted N = 20 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

64CA030866290F73 D6F9F97FB9CF7306 5D9380B823695AE6 97813E33459D1423 E7D4AFE03DFACE59 A09D06A1C475F22A DA5D1101D1D5112B FBB2D6A7B431CBDD C178B1B3F18A4B70 A28558A560CDE2AD 443A19CFBC6D1AAA DAA462FC4EE204D6 20D2BC7247AFCD8B 74139888DBAF3AAE 143BE3A2558C5A43 46EB98F9008A10CB 34C6734E8AB953E7 D001B6B40555F477 E730E24BFD4E5127 8CCEDC3356780520 AB54CC69F26922E3 9580CCA0BBAF0104 6C7F878C66D100A3 9566915CBE4CB058 1298D16770FEC229 F31BC8180121B505 B7A34241524D5B93 CE6B87B50569CC1B A060BB042B56A883 ECD83726136C59A3 0A54A6305CF29B53 4668571A975350CC AD64274E31A90388 8DB648844666C5F2 90C42744E2F7DA89 B470B37C41FE1B58 38F9894E5D60AD12 F712F48A11B72027 E8CA1AD5CAA0C662 FACE4B8A5EA9DA3D E72F2878A498F1C5 0D8AB4958203E38B 0A6F739BB4B524D8 5E199BAF0C38573B 2964B2B9F37B7942 194B00999CE51482 524B560A7D06100A 506B7CF043FEC619 BFDB37C2DCB06923 833683B00E8CAC23 BA363EB451FBFD13 3E7C2FD0554A67CC 391F2AA342F307BE 05FB548E9787D11D A21CFA28BA495222 D02D5D291F589040 F308833D72A07639 A861D051BADE9081 E9373BFE7CA0A347 AE11463B69D875A5 C9B00E65F0C5E98B B470DEFC3DB7C765 BC1315CE879B1E81 E583DD9390CD246A 853D585918C2BA44 7F74ECF8AD7A66C0 F739AECB1FDB9BA9 0848DF1457FA9EB7 0F9E01B682938195 E3473931DCB7482A CA414D6F5BC88AEF A6EF21A4BA418E77 9EB72768247D65BA 19642E4CD2ED4353 F5942DBE03312F94 34EEA1AB015F87BB D5D66C31D8CCDADB 753328543A3D0BA4 1197314074D8D53D 930B93BB6C9B1566 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3854bd00-bb8c-2848-a044-b0a0a1ac1fa0
  2 d4ada9ad-6695-303d-9ce3-1b8b407ac32c
  3 8f0ae2fd-6885-189c-8eb3-3b196609d5e8
  4 8945c14d-0dc8-8e10-aa50-a633d11799d7
  5 1c0445c5-2711-16f6-8836-b85f0b3fd280
  6 ca54ce10-d5d1-11b6-b427-5189a0352cd9
  7 bbe456a5-8133-526c-8801-88f0d55fd702
  8 bd3f88a2-6418-4f59-9f80-1e33b952eda2
  9 66b73656-0559-1fc0-a742-d156dd61328d
 10 05e378f7-d8af-4f5c-a17b-91123fbd9b7f
 11 3097eda9-ad64-0f0c-b634-9827656c9bc4
 12 ff9a67b2-d8bb-5b81-931c-930a3e8a1d9f
 13 ae995134-4d1f-1cfb-9353-fe23bca1a627
 14 e8d605a4-00ff-8392-bbcc-81a615987860
 15 808d18fd-08fe-23c8-bb1e-01bf6f00d4b1
 16 3733af73-825b-46aa-84aa-a0872c11b9a4
 17 0bb36be5-5e30-5175-86d4-3ca15949e831
 18 98743c11-c8b3-1a22-b0e8-bcb150113266
 19 c8806ce6-7b84-0ba9-8fb8-59332486f6e2
 20 6d3cea2a-103c-804f-aedb-4b19a50495f3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 23181154140518245108. Exactly this sequence comes out of new Random(939).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 37 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related