201206302251 vv2q4

explained decrypted filler

seed 589

Metadata

Post ID: vv2q4
Title: 201206302251 → 2012-06-30 22:51 on A858's clock
Posted (UTC): 2012-07-01 02:49:29
Timezone: UTC−4 · title 22:51 against posted 02:49 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 10
Filler GUID seed: new Random(589).Next(9) ✓ verified
Run: Probable run 1 (seed 293,378,646) (probable)
Draw: 0 · predicted N = 10 ✓
Machine boot: F 2012-05-15 19:11–19:12 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: probable

From the post to its content

As posted (encrypted)

BC9B95330ADAD7F8 B3787E0FDB949799 945D07DCF6A2CC86 26D1631D28DC4963 E1D053B8DEF7FC3F 9EE2B4740E786BA0 7EC22B7F40D2143C CF46872687189756 C70B17947A48E00D D6CB0850A102BABF F6E516D0B1267B45 B94A8C1EC305F305 BA7546B8D4709021 20521FF08979F89D EF0C02EE32C95EA3 83A90F8F0FA8C0FB D0C03BC6A599A780 23AEC68E60453F11 A6263FDC50023D5D A870CF2F2D673B43 8E6242E5540958B7 FCE3E26EA3DD9028 F3530C94ECD6B8DD A557A2535A6E7FD6 B1CF1E02D40ED31F BAEDF24CCB64CAD4 E1E7AF7ACFCAACBE 8984591FC659ACFF E23FB0359A67A550 304194FAA17F1511 44A84BB341F2582B B2D20C94D043C1A0 437FCAF6F0D107A6 2523C31F2B83B252 5221BC7C69542193 DD889DEA5B0741CD B836C3B591D55E2A 6DAE888DF1647260 E2F615856B6EC3A2 FB9AE1CFE42134AA 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 606582d4-c6af-3b39-932d-422f754344cb
  2 795dad10-7f7e-5747-82cf-dd431e49f4bb
  3 a3b4eeb3-67f6-403c-9c2b-fd6e0cafe738
  4 8d8b5de5-7a84-2c41-af03-114e458f16fd
  5 ce2ee805-eea4-1510-a256-6a6682664ced
  6 be507ea1-144a-2ad1-9f53-da478db57627
  7 2ec3c2d3-0a6b-7c9d-9460-b51bd4898cfe
  8 f10ff290-1f9f-8a1c-b220-d418c4439cc4
  9 dada82d5-e30c-7178-999c-0a4cb42602c3
 10 5724647b-8504-4401-848c-77ebcadeef24

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3542127874. Exactly this sequence comes out of new Random(589).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 0 of Probable run 1 (seed 293,378,646): new Random(293378646), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:12).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related