201207031735 vzzwh

explained decrypted filler

seed 140

Metadata

Post ID: vzzwh
Title: 201207031735 → 2012-07-03 17:35 on A858's clock
Posted (UTC): 2012-07-03 21:34:00
Timezone: UTC−4 · title 17:35 against posted 21:34 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 11
Filler GUID seed: new Random(140).Next(9) ✓ verified
Run: Run 10 (seed 38,548,093) (seed)
Draw: 24 · predicted N = 11 ✓
Machine boot: 2012-07-02 09:51–10:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

131EAAA1C8AAD9B1 04BC94A6CA9F10AD 30B7F878485CC08E A0CB45EDE5F0A07B 666EC46163BDC663 CEB5D5FB644FA65D 1B7FEBE087C28CC5 2D6D8889D51A8104 F2C57942E3D9D3BD 6227C4743416CE69 4A0B09B09D10E529 688CF1E2A6995699 904C862C9E67EC91 08D2B90F1BFD4E2C 17349B6C9E5A2CB7 036D11D1C3E38BA6 AB49EA986C264E0B 8EAC84494788844B 99C5F697D972D623 CBE0B64ECBF81885 4CD1FFB4E1B45CAE 4862CD487DAD14D8 2BE6269FB3CFDFFD 98827ED841C369D3 3B133CAF6B65BA98 569E856B0D163026 B642F9589866DA20 CC8086D62A4C09C2 B368D79AAF838796 335AB72209598EB8 940C7A854B09DEA6 A0FF126E40AD6131 1AAAD840390B95AE 065D2D0CBA25C5B2 AC80387A7E146D15 A13F039458407E95 1D8FB0F5DFF7E70D E454D23EDA37FAEC 3F3E172E714D1B4F 07BA1F0157470C6E E7BA2CB1C13C8FB3 5019195508FCFDAC E6827FF4AC41DD6D 814CC4B1E65B2CEE 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 76f7c083-badd-74a9-ab4d-e4d8dd12cb47
  2 a30ee524-f91e-840d-87d9-ddafa6ec34fb
  3 8ee303ec-1041-5922-97fa-7c5d983d2e91
  4 8edd5262-54e1-31a8-a796-130a1a201fa5
  5 6e9cceb1-d066-3c96-b4df-a6edfa44dbaa
  6 4a3bcdfa-1886-8d7c-b655-70993a5c5ee9
  7 6aef4d8f-153c-56d6-bd0d-886e926ff567
  8 d58dcacf-e828-6d25-9d71-68c1e3f7baa4
  9 8337dc29-9145-2b19-9fd6-7080bb2ab18e
 10 21de41fe-7b5b-8010-b96c-65926d80a94b
 11 47f76922-2306-3a4d-97b9-8fa1436608c2

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 78533856283. Exactly this sequence comes out of new Random(140).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 24 of Run 10 (seed 38,548,093): new Random(38548093), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-02 09:51–10:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related