201208080039 xtvyb

explained decrypted filler

seed 206

Metadata

Post ID: xtvyb
Title: 201208080039 → 2012-08-08 00:39 on A858's clock
Posted (UTC): 2012-08-07 16:36:35
Timezone: UTC+8 · title 00:39 against posted 16:36 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 10
Filler GUID seed: new Random(206).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 24 · predicted N = 10 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 16 · 8
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

A6BCE98323FFF3DC CF0ACC364EA37B79 7127D0B4B215E2E2 0363250ABA453E81 30C03213CD9B2B7F 278F4AF633D6F11D CC00F58DBE65ECDF 64D2699C8F076832 DD2D056CDF88649B F20EFC6C7B77654A FC4CF9A943DD3E11 153F313ABDDDF0C5 10CE86DBE599BC09 3E4BC1249E4F5937 A9B1B83CAB90485C 3E00F2F79BF0BE0F 7A76C1AFC0EFF1DC E899C326F1A58855 A1A7F65651FC9F7D 05696889D8D1F250 FB590847EB549D61 AB35BFAD40BE60E7 3FC4FDD3D2828FB0 C646681CCF33FBF9 78DA8D657EA39CE0 B370C9F7264F1622 EE29FD6CC6D7F06F 78B1AE6B001F5624 60E0EFF60C1513A7 7DB1E84E0DF98340 F09613729F945242 A33C1D28B91F26B4 F72C06F518B14B86 46BFD19248460739 0AEA46B0B7756D93 7481FEBF2E519C0B C102E7AB3C447DA5 7F15826930489DFA 76CD44EC94006762 10427A5D24801302 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 247533c7-d39a-3141-bade-c20c08b288f6
  2 4dbe0fed-cea8-2a74-bef9-9e8a3ad4de74
  3 0df09ba9-dc97-6ea5-bf2a-3d9458e0c40c
  4 e0ff70b3-db3e-42e7-a0c1-9491e21a128c
  5 1544d941-9d3f-15d4-a921-6c20ad3b2ba2
  6 f2d84737-8547-5058-8d56-b04477db1554
  7 cc5f3464-b0e3-18d3-95b6-167c6e868b0d
  8 9ffad4ef-f37f-7b70-a26c-ab788416f59f
  9 100ca5ab-7d75-49b1-9385-fd43e044e606
 10 8e661e1b-c968-2997-974b-ce0953fbf094

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3264151742. Exactly this sequence comes out of new Random(206).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 24 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related