201206271306 vo5z6

explained decrypted filler

seed 936

Metadata

Post ID: vo5z6
Title: 201206271306 → 2012-06-27 13:06 on A858's clock
Posted (UTC): 2012-06-27 05:04:24
Timezone: UTC+8 · title 13:06 against posted 05:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 9
Filler GUID seed: new Random(936).Next(9) ✓ verified
Run: Run 6 (seed 652,173,660) (seed)
Draw: 40 · predicted N = 9 ✓
Machine boot: F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 8 · 2
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

52C17AAD01974A15 091664D672DEF2F2 5EFDB2A15950F869 F71F59411387B17B 6D14EAD51E8905D7 B5D1B334B2DFDB94 546AC06BFAC985E2 A62C51D34E6C1FFD 7B460AD0D6F7E81F 4BB81892C0DA69A2 FFF13D8C75267E97 4DA30017846279E7 41B9FF6F911DA859 E0ED98C802E45DF7 244FDBEF234D82EE 645BFC2E39CE8642 4E1B43668AA90F16 BF86C6562780C07C CBC45454029AC4C0 40B5F974D541D2D4 A2606CAD310FB601 EDAB5E4572B51076 8F23CC287F463E8C 90D581EBE7C46D40 80AA01E6E5C79501 6C7B57372A3BDF86 AB7097CAAD136503 8298F46AC43B818A A96AAAE467D611A9 19991E6EED67DD7B C16A6B12B753F9A0 1B7DB9145EA7CCD1 640E9B842ED9B216 0E8B5C4A10825695 BC56E57BECEAF468 06A44C99B553938E 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a26789bf-f893-690a-9bed-c842d88d1191
  2 359ab352-c010-41e8-8634-8a22a5bfb129
  3 8920bdee-f888-0fee-9a45-c70d64894987
  4 040acb3d-51d9-3780-9ae7-13029d18dedf
  5 025707f8-ee6a-7a5d-b340-56224a1195db
  6 34215351-2fae-4a8d-94c3-2ba93669cfad
  7 85f537e9-9097-21a1-98a5-d1f0c2a066e0
  8 18e284ed-9526-0fc7-8a07-f302cb51fade
  9 30b45c1b-bba9-6461-98c4-277f53624cc4

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 640374206. Exactly this sequence comes out of new Random(936).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 40 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related