201206271329 vozwj

explained decrypted filler

seed 626

Metadata

Post ID: vozwj
Title: 201206271329 → 2012-06-27 13:29 on A858's clock
Posted (UTC): 2012-06-27 17:27:23
Timezone: UTC−4 · title 13:29 against posted 17:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 12
Filler GUID seed: new Random(626).Next(9) ✓ verified
Run: Run 8 (seed 593,707,075) (seed)
Draw: 6 · predicted N = 12 ✓
Machine boot: F 2012-05-15 18:59–19:19 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

F37671193D7DA2E8 6874459608A44863 F07E57EB7B72681F 258081D67C365B6B 16AB823457C17E1B B9D7EA064D5104C8 81A35D6A2070ECCE 77B4AD43812784E7 73CE07AB69A32800 E10C58513AF5EC2F 417086425C30492B D6EBC8F0BCB48135 B6F6AB1CD7DF6DC3 1DDC002CD6DDDD54 D6D9FB202011ADE7 E1F28187D915C174 AAA71836AC017116 46E289CFA665C785 B67CCF5168538157 36CE55A44E5747BD 378FEBD3C38C6D4D B0A5BA8D609792AA F1E1A1428933F075 240A1F60E1E705C9 59EB59205AE2AEB3 212242A8B3298C56 5300EE1FEF12538C D6F2E88EC844E7C4 93405EB73E9E1B2C E699B944DC9F713C 4E0D33458722E27B 06400C47931A1DAE 84702C5AFB9AE39D 88482851ADFF3A45 AD50A5A59C7BD232 23F950D4186A0D28 E217FC14AE15051F 8E03A2F8DD2A9976 9905C52A465A1527 3E12D832004E8ABB 8BEC790E2736B548 CF66C0850332D957 AE7CD7F027AC7AE6 97074A3384EB8938 724D2CEDF5C71403 FA7DD14BB3173BC4 E953388ABF095029 FA3CE74ED9282693 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8123aca1-e6f6-669c-b524-94853870a48d
  2 0a4177ce-7dfd-443d-b86c-75a435fa67e7
  3 27a6623f-1981-32a9-85f6-2968dd00186a
  4 8c5fd565-5dde-1726-bf84-635643043d18
  5 ca89a4c0-bd73-7678-93c9-5f4f67b28ced
  6 7edae014-549b-526c-a39a-c55922c6d6a0
  7 2b33ec73-0673-3503-9ed6-a349f4d0eb5b
  8 aea91c4f-164c-4f7d-9ca0-5effa3e35e16
  9 0fa2f15a-fd5f-3af1-aa31-09007c3010f6
 10 e475b3b6-70e4-137f-aa4a-da26b522aaa1
 11 b8044035-6988-4837-bec3-d04edbea911f
 12 a0561ace-a943-185e-aaf7-8a721cd0b9b7

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 643175343141. Exactly this sequence comes out of new Random(626).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 6 of Run 8 (seed 593,707,075): new Random(593707075), Next(8,24) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:59–19:19).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related