201207040036 w0lzs

explained decrypted filler

seed 265

Metadata

Post ID: w0lzs
Title: 201207040036 → 2012-07-04 00:36 on A858's clock
Posted (UTC): 2012-07-04 04:34:07
Timezone: UTC−4 · title 00:36 against posted 04:34 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 15
Filler GUID seed: new Random(265).Next(9) ✓ verified
Run: Run 10 (seed 38,548,093) (seed)
Draw: 31 · predicted N = 15 ✓
Machine boot: 2012-07-02 09:51–10:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

F8A1ED1269A65D55 EEBDF296AFECBE2F DD235378AF18D140 EAB96DC7DB720904 0FDD4839F92FF9EF AC65B9FDF434DA6D AB5A2AE2629D1D6D 1919390C165851B9 81C32538D27DB86F 82E8E11A5327F49A E3B3FAB29607B782 39F32B2A3844C749 B56189891BAB2C2F 07DE14C83F8B514D DFB8CC456FC64970 84A57986EEAC76B8 F750FC49D1E156CA F5BA97BAA5F6008A 4F0B6E4FF6671F6E 911269A03A8B2720 E52059FB0B51FDC5 93ABA5D6527043B0 7C1087334C58318C 5C10A654853D3A3C E4B0A83C41F7AA42 DEFC3588F3B9AB83 9E81BE19F4D4FF2F 139CCB10F40BDE19 6C30AB9242C16C27 EC745DEE462657C5 A2D7BA5F4B851604 0D8ADDE0A719904B 605E7D05D59DDFA1 566A4AD911321562 BF3CF7C8B540A89E A55E90824CDCA162 0802852980861267 830C29320CBB9F1F 8D26022C92ACE9A2 048F8CB84292E43A 0AEA2CFBA97281A6 6B226DD00BCC8A37 7C71766DCB4C8E07 F1D0C843D2B85C25 61026A220BDD821D 35524676EEE63C72 DA511D41E0C774D6 1A5F415A8F486D1C 8441BE1FC10B4E85 5164B1AAE3F33BF1 5F3DDBFAE9479284 AF7193267E0A1124 643F5B17C38AD3EF AC9DE3CD8A3AF1A1 08A68809A96E65B1 D3A31199D5D6C190 C22B2EE530E6A2F4 43C61F1DA267B591 7500B5514043BB59 E4C0BBE0BAC7A2EE 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c4799cb1-a6d8-1095-8c7d-7b6c8336615f
  2 ccf421ea-5cc8-52c1-b06c-25fd51c3210d
  3 b9f6fdff-fe54-8245-bedc-af4ab64d3893
  4 18041dc3-1d29-11b1-9f0a-752ac41c7b1a
  5 3b25d738-e5ca-7cd6-be86-a66e5cefc3a3
  6 9c60f6cb-52d1-153f-ab5d-0762de808750
  7 060b2392-a345-54b9-95a5-ab3eb839365b
  8 b8c16ed5-7a27-3cfc-82f0-331af4856925
  9 90032534-0ce4-6200-9043-3445d8555293
 10 d234fad0-0161-838d-a03b-e762d29b5687
 11 9935fab5-c791-403e-9db1-8598df3e030c
 12 c8868cf9-94eb-31f4-9952-d34511de6ff7
 13 9ba75866-07a4-75d1-8498-d39db1c898b6
 14 78147a05-b988-311c-9820-bf0c2c81de58
 15 640d7fa2-bfc2-49d3-b8b2-6610580ac6fb

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 158171536843734. Exactly this sequence comes out of new Random(265).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 31 of Run 10 (seed 38,548,093): new Random(38548093), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-02 09:51–10:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related