201207031835 w03ei

explained decrypted filler

seed 468

Metadata

Post ID: w03ei
Title: 201207031835 → 2012-07-03 18:35 on A858's clock
Posted (UTC): 2012-07-03 22:34:02
Timezone: UTC−4 · title 18:35 against posted 22:34 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 9
Filler GUID seed: new Random(468).Next(9) ✓ verified
Run: Run 10 (seed 38,548,093) (seed)
Draw: 25 · predicted N = 9 ✓
Machine boot: 2012-07-02 09:51–10:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

3835923A7F3B7ACA A18DAF4F5341067D A9DDC5CF045295E7 6FA2DD7B1CBCDE79 B027CFC1D91F54D3 DCE8ECE574E4E303 BE0B178368C9864F 6F2DBF41CA1F7FCC 234653F53E83AB18 B0CB533908A038AC 1AA7C265128BBA75 4B7BE39C227BE338 D3A9292484017B31 2BDCBEFD5792EA06 2106F81BAA326919 7FF404EA707F9504 BE76AAEBC7DA11BA 41F75407C64B9160 2F114FEEEC2410AA 7A3F9D8182FFDCE2 6B4156B39866C6DC 940AA936C81BDE7D 8C4F5D3871CE10B7 63F69A077B33BE5B E27D9B99626AAA3F DD99F01DA348E9E0 72AA7B00D04786EF FD94CB701B204653 52BB9F11D82B5682 B75D4D5264298CA8 68E2BE01EA9D9887 91340E909AE07E7B 183D50B4EAA4095B E091AF68D283D160 E4E7E0C565314B28 6A1B789BC6B99DFC 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 87675a54-a129-183e-8aa5-768eb35be01e
  2 9fa3559a-a9ed-1db6-b263-c6149b2d1cae
  3 b50195b4-9f8f-8d81-a591-5659a0365ac2
  4 49c9f169-4e20-46e0-abcd-fba1241c6803
  5 9fa1bee2-d8ef-4903-97fd-e4a2bfc0abcc
  6 39f78431-b290-424c-b026-e75fab889fdd
  7 fd1a979d-1e79-5dff-ac29-039cf47321bc
  8 98bd7fd7-5e69-20ed-9388-ab9d0ef43783
  9 f6e3113f-a87e-7e63-9d1e-58f5dd3eabbe

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 118444527. Exactly this sequence comes out of new Random(468).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 25 of Run 10 (seed 38,548,093): new Random(38548093), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-02 09:51–10:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related