201206290625 vsl4u

explained decrypted filler

seed 476

Metadata

Post ID: vsl4u
Title: 201206290625 → 2012-06-29 06:25 on A858's clock
Posted (UTC): 2012-06-29 13:24:10
Timezone: UTC−7 · title 06:25 against posted 13:24 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 11
Filler GUID seed: new Random(476).Next(9) ✓ verified
Run: Run 9 (seed 449,725,219) (seed)
Draw: 27 · predicted N = 11 ✓
Machine boot: F 2012-05-15 19:12–19:12 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 13 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

6CBE7AB8FCEA8B7E CDEE53B560E42DAB 75D5A2EBE8126F81 7C3D664CDD7792B6 36B143BD0E7F4AB7 6E89EB36BD228369 184C2E4B4F1C8A1C 37808D9B68346F82 88EDD8DA80E2E9AC C20AFC9C189A49CE E464883335049540 E76E2EEFF94406E1 BADAA22379F90FBC C041FBAB0FE02540 56626C3E25299CEA EF2335570944C895 6F20532FBA173FE0 561DB131F50FF913 BE5D1D79BDEB9DFE 04A811D126FF620E 71398C75760EED50 80F95BFB8B58003A 0A10CB122623618B B30B41B81D1E7977 442262C44A4EEDA4 0561A2A471722A5C CAD1F71A27F79FE7 C82BC458DD4577DF 4DBC453394D15B1D AA012802B0562580 865FC8C0A13D58D7 7A7D97FA3BBF26AF 8D3B48298C725FD5 412C97A03E8B5887 59A02CC3CAB204DB 64EF3111AFEB16B8 3A6683D1A853616C F13DBE41D373A4C8 194B18A550D7B28B AA903E87B65CEF09 349AB2A9CFDB1D94 154F7A4B0F35A917 21AB1FE49F134191 DA165E2689D75D3D 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5d694243-9f06-3eac-a9ba-8d66b38decb5
  2 f8491aa5-9edb-47e2-a5af-7d3f81d8632a
  3 005aebdc-0b85-4026-ab24-ac8cec1a711b
  4 cbc1ce95-128b-1321-8aa5-6dae2794b86c
  5 95a0ca19-7d0b-1091-8943-01520fec8f4b
  6 b15b6ca2-3a16-4061-8aa5-35b516eb72f1
  7 6ce569b3-7227-1735-9b1e-ad2c9d825089
  8 d5131a3e-99d0-201f-b200-ac1d775e6c60
  9 ea8308aa-fd21-7d84-9bfe-d1cc8f2231ae
 10 c1c280f7-362a-7549-bce3-d40c16122626
 11 023d4566-8458-867f-b484-91ff0679c235

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 34411412778. Exactly this sequence comes out of new Random(476).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 27 of Run 9 (seed 449,725,219): new Random(449725219), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:12–19:12).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related