201206272213 voloa

explained decrypted filler

seed 568

Metadata

Post ID: voloa
Title: 201206272213 → 2012-06-27 22:13 on A858's clock
Posted (UTC): 2012-06-27 13:12:02
Timezone: UTC+9 · title 22:13 against posted 13:12 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 10
Filler GUID seed: new Random(568).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 22 · predicted N = 10 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

DBD129D9622C789A 0EDF613F2A6CB39F DFB54F15F3020ED4 5E535BC0B03CDB56 A6351608C4463E87 24700CC2B6DD3707 05C0376A40F3221B 655F4A4575702DCA BE7B82452F716617 3791D66C2AA22812 343B868B97C5501E ADA4B7374D38F163 27E067B4B02D31AE 7D35C85CE659F133 5FA2E9D0D68B327F B3956B3E60D6D0B4 0D7845609825FF68 436B735C8D02AFDD D7FF2A706B22365C 80FB1BC5EB9C006A 4408AF2CCC8B07E5 071E166F3E26B565 7CAB9FF4EEB25A11 6B7B488E4DD8BD12 47D827767B717783 2DA505E7465186F3 EFD4C180644607F7 A425FC6FD2BB0AEB 883E8718538DADFB B1DB786A2C408725 839FF2D5625D3D2C BBECFEC888EF8AC1 B40ABADA8FFCA79A DAE63C2AD5DA5AA4 12EB97F23B10A008 6CE29BAEBF40CFBA 5A7B92E8894F3FD4 F9D6D251D8671ECB 821A2FAE691789B9 53C3D824921B1DC1 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5042e0f6-c685-40e6-a2e9-7097af8ed513
  2 64a63661-ccc6-468d-9a8b-2d49c73ffef8
  3 528f3462-f278-709b-ad5f-bbe134bebb6d
  4 f935c9f0-dc4e-77cc-bf8f-3e4c3109d1d6
  5 66d80fd7-bb3b-5603-9b4b-fabbf9d164da
  6 844a5cb1-57de-8f64-ac71-cb83fca5d366
  7 2da25f3d-91f1-326f-992c-9982f5c528ae
  8 fd114959-7a27-3b6a-9b15-bdc8f0af90ca
  9 8fc05fb9-0412-200e-b61d-2c8831430b04
 10 77def4c6-3c73-6cb6-b3f3-97eca73a0264

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4477583326. Exactly this sequence comes out of new Random(568).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 22 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related