201206272346 voq64

explained decrypted filler

seed 916

Metadata

Post ID: voq64
Title: 201206272346 → 2012-06-27 23:46 on A858's clock
Posted (UTC): 2012-06-27 14:45:08
Timezone: UTC+9 · title 23:46 against posted 14:45 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 10
Filler GUID seed: new Random(916).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 28 · predicted N = 10 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

C5E1A4EB0AC2E1CC B45E09FCBC5E478F 7C62173B7822EB4F 4CE3F61E79DBA46A 8ADADB368BE52737 97B3B11DDE4F1FF4 B68C240B77D82F6A ED1675021B84ECE1 5EB4729F4745FCFF 5D219BF11FEFDB7D 0CFE35B0D9CBAF06 21E5545BECBC14B8 C3C1B6AE0E049453 F6C075ED80436911 EFDED89CAA515CDE E172BB5FE698E4AE 405C5CECC2DE7D91 4F5A90EAE551891A D82E9869068B51AA 27D91089146180D3 3F4D456413ED9772 71F62ECB572DD5E0 0E28BFB54EE7C808 06F9A5CB3EE299C1 DB34832805FDD310 3C84DBBB67E27D10 94474C074442EDF6 F2C615541A874A35 D3711A87389367C9 C57CF50BE64A8B10 B71017FC03F0049B ABB5FFE28CEB9803 56A9F7D37D410A34 E47A48485E4EC375 F49433699A02ADA0 596AA554DCD154D7 608356B27C343434 BBFDA20685D507D5 122BCAF0FB8E4A34 9C875B7EF56267D3 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b1c2a1c1-7084-251a-a207-901c0e5eb33b
  2 9382ca74-6021-5b2a-a1a3-0a4273bea9ec
  3 1909f67b-059b-03d0-a788-08ff7e8cb6e8
  4 3d7c0dc5-40e8-0e2d-a324-b2b60c37e1f3
  5 41c5f3c0-5c02-6010-bdda-568044a6c341
  6 c1b9dc35-fb0c-0d49-95fb-8644ae44396b
  7 4e43911e-4e15-22b0-9f2d-3e985cb38148
  8 78a4a8b4-671b-83e7-87a4-da2397456436
  9 83524d41-4c34-2a2e-a1aa-029bcd936f78
 10 cfe91129-ef50-0eef-ada0-1522cae2c000

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2500602820. Exactly this sequence comes out of new Random(916).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 28 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related