201206280002 vor01

explained decrypted filler

seed 202

Metadata

Post ID: vor01
Title: 201206280002 → 2012-06-28 00:02 on A858's clock
Posted (UTC): 2012-06-27 15:00:39
Timezone: UTC+9 · title 00:02 against posted 15:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 10
Filler GUID seed: new Random(202).Next(9) ✓ verified
Run: Run 7 (seed 629,367,141) (seed)
Draw: 29 · predicted N = 10 ✓
Machine boot: F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

2DE6CF9C9BEF789C F95FE5E7A3355067 DC8F590FEED9BECB ACC06C8506E6C0B2 3F60D97F9B0B353C C4BFF67166A252BE 1CE0543124F7AC70 CF066B8414A3FCF5 0F8D9FA547763333 2CD590AC3D68D2D3 FB6856FF977A6704 C9631B2A778C50EA D693609E209472C9 26668240C91DA01E A6B8D1007A74DA1C 68DB4BFBE991E47B E37C24032C8261E0 31279781C1F882F6 8D52C509FC524073 0607AC2AC8883FB5 2A40C818CBE12E97 5799211D46FA9897 4504328D52065016 C0BD133C7FD248BE 40F5552F836D1A55 D2C0DCCF9B37AE62 626CDFCC0418256D FEC55C7661E44A96 5DDF56656453BE7B C273DD5F06374153 A07277AB3FD13EE3 E76FA5868652A9E8 30DC738D9221B678 29E89592DC783B18 2CAD3F82594FB272 AEBF4EBBB7726896 5128C8661CBF33D9 60E392F44157E93E 0F79B196AE0FC780 40A4362D2B9B7CB8 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 69c2e7e7-4115-2042-aff4-f23aa0f9ec6c
  2 3bae5d40-5702-0aa2-9685-e8535d801d8e
  3 46b14b38-67a7-8eb7-a180-3ac9cf99b1a4
  4 004af82b-40ea-6d22-a1f9-20aa5ae43ab6
  5 9e495ee9-7072-3938-858c-831e9e46648c
  6 5cea6529-82c9-064a-96ca-69132e45174c
  7 03309824-b0c8-3deb-b711-5421c07c1089
  8 b771825c-d2e5-7ceb-9120-92bdc3cd076c
  9 e509e1af-5cf7-8913-ad15-37fae2f44ff7
 10 48b0df33-834c-6c57-89cd-b97583a41b97

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2086303786. Exactly this sequence comes out of new Random(202).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 29 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related