201206291040 vsyip

explained decrypted filler

seed 854

Metadata

Post ID: vsyip
Title: 201206291040 → 2012-06-29 10:40 on A858's clock
Posted (UTC): 2012-06-29 17:38:46
Timezone: UTC−7 · title 10:40 against posted 17:38 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 20
Filler GUID seed: new Random(854).Next(9) ✓ verified
Run: Run 9 (seed 449,725,219) (seed)
Draw: 31 · predicted N = 20 ✓
Machine boot: F 2012-05-15 19:12–19:12 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

EBAA576239CA69D9 6306821F86C9167B D9F4AF994B376AB7 820BE657EA708A6D C4FE837E995A164A 1F2C915B3B778E36 E925B60B1F4A86FD AF83FE12D07A9D14 37F7ADD35E1C0249 620E1609CA7791CF 04CF14E34B106A5B 9AB00FA8DB995249 416EFBE8E8563C43 F91087BCABFD66B4 AB68E052018E49E1 6DFCA839800895AF F7C366FB125D8446 D4262342432BC7C5 1C4A1FE707F69553 67FDE48014839CAD BB62F5B9DBCBC294 39AF44B4776E3888 CE77DB4A1FD45CE6 C067784D2B00C8FB 0B2F77631208E36F 5176BE09C0879BC0 5F0FAC4363915C5D 3CCC69B18DDB07A4 9B91532D47F64B0B 6F55395E592C913D 612C2D8498980995 23D35D7DC582EF12 B8BECCB0F79BD5A7 42D23AEB63C707B3 27262FCC884753F0 42D4BA814957BBF3 E975164D71AEC6F4 974607F901C0D1E1 25713A8AFC52AE13 394291674BAD1454 A128A3364D8151CE B14715F88176826C 28B6F70B7EB4C559 674AAB3834C035F3 3B87090D6662159B 6F928FC9195107E1 22A850E59C658ECA 6C8EFCF862D45978 8CE892B950C8065C F92BA5ACA1ABE58C AEB99BBEEA3F5AE5 892EB216B99D2A44 6EFBBB2E5AC5F14D 6CA983E9F677AE2E 10FB17B2277897BC 2325E7CE3239A44E 2D1F780F00F43B66 524B843973BE7257 F8971259A2C65DCF 87BDB4F2B1F244A0 DF3C0A41B1FF83A3 66B792EB7DB3E29F A0EA2DFD0A41D0E6 4BA0F2E1E49A269D F99B2D91EBC175BD E27503E2582B88F0 1900B7CD259DDF6E 56234CC602AAEAA7 8E68A75C6BA04FB9 3C40B4CEEB3793D7 EDD60A8F46BE631D 86B5C22EF4879E78 4F80E794F899ED74 C228FA2CC2F0E302 7F9CDC8CBD02BB40 7A055CAB8BA96A9E DB495716939E4D7C DE53B76A32E3D9CC 142B8F79FC29C0E9 64A3613ABFEABB55 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4372bfa0-957f-7b85-b750-800e2f25bd34
  2 637ec81b-27e3-3428-993f-40c45565d8ae
  3 e978269a-9984-6a75-b9aa-ddf8e5b67c93
  4 7a921fe9-fe4c-757a-bd77-19ce60b576c4
  5 db7ed0f9-3963-6d39-a538-9e10e6e55342
  6 d67fd653-9057-7cef-a9a6-be3ffcd7f6c8
  7 8ae2922d-1903-416d-98fb-9dc8562692d0
  8 de9ce743-2c1e-7a16-8530-a82137f40dae
  9 58e61a82-7092-535a-aee3-fe6884ee5994
 10 45b73642-3064-1cfe-9374-bb1c801b12cf
 11 13bc93c3-4954-43d1-af95-5aeed3e34a48
 12 197169bc-44f4-178a-a332-1334c2ec1823
 13 3de01839-6c0c-6e15-946b-bb75754260fb
 14 7d03f8bf-fc6e-6ad8-a188-12dd07dbbdf8
 15 1452cdf9-a72e-6686-8a4f-a705503dd417
 16 831cb834-b2d6-3f74-860a-4eac02011367
 17 8c64f0d6-5c82-70c9-be06-9fd12117cd5f
 18 fe748ffa-40b6-429d-8739-75b44d1c9de1
 19 62a6ee06-7e8d-70ea-821c-be038e62a12a
 20 2cba7e08-bf53-8673-adb8-1dea289a4b41

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 73676747514166637478. Exactly this sequence comes out of new Random(854).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 31 of Run 9 (seed 449,725,219): new Random(449725219), Next(8,64) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:12–19:12).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related