201207050111 w2hsk

explained decrypted filler

3DES(name) ECB, 17 GUIDs, seed 46

Metadata

Post ID: w2hsk
Title: 201207050111 → 2012-07-05 01:11 on A858's clock
Posted (UTC): 2012-07-05 08:10:00
Timezone: UTC−7 · title 01:11 against posted 08:10 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 17
Filler GUID seed: new Random(46).Next(9) ✓ verified
Run: w2g3v (short)
Draw: 1 (assumed: numbered from the first post)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 8 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: short

From the post to its content

As posted (encrypted)

0613F5EE44C1351F 0B777DE03502C8C4 12914FB77279F12F 5C869CEF09DDF642 1F9B5D66590E343E 18102505E4107F51 18A2C93937A46F86 05E47E64D7AF89ED 0A35A3739D4F042E DA6D42A64B71DC2A 58FDFCC658CFC24A C9012C762B6D2D15 1871F59C0A9EDE47 6D82B31FB112CB2C 3F1EECF95664D51F ED9D8EDEE259122C 9530707507C2B005 5BE01806C77C534A 9D3A8D99752C7081 A7E9AED1EAEBB28D 04A1A80634053ECB EE81BF196AACC72E 3D33A1CF09771336 DC01C9CFBF9B7635 BD57958813001BD4 B43AFBEC50339655 B6ED97FDC9077D0C D86BC5121B6EDEE2 998E712181D18DA4 94020F1B34B8E0F0 C5AFABE4D06843A2 8D4481CC1C4DCADF 4F489BC34607180A A045FA6F78FBFA12 96D9267725E6DED1 1AE840A54A8949CE 5B380D0D5E660C5C 94FB1710ADD23BF0 EF55966942EF2E8B C27A1AE9556C86D2 633A4269017584C9 5494330DA98D30B9 64DB6338922D4CD6 0426507F14B3E1D6 5347330072C31623 2970108E4AF1828C 12510EAC15909115 97D19268703D5580 5E76D21F39859AF9 71F8E05C3210E036 3A40F5DB51FAAF62 7D62BFD67AB63D02 E8508D031066EE0A 490B74B2EAF97B8E 3F24FD71ED288EE2 C499661178E425EA DC0DA4573339068F 4DC95F1C1BFAD0EC E44A46A5B7F52CA4 6FB22D34DDE8CA0B 2DB7C8E13A9672D2 14329BC734AFF078 E61D8BDF7C010BB5 2E3594074848C5E8 E57E16163AC8E944 8AF366A3810121CA 742F7F1C9CF3D939 FF7B556475F0899B 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d7f24441-8c58-65af-94f8-464204e19e99
  2 c67dbc32-6180-2a05-b49d-d5bdfc68e837
  3 5ac618c3-6449-8eb2-9db4-888dc1572c36
  4 3d3cda2f-2b69-3119-995d-f3ff496bfc2c
  5 64f689c1-70ae-88eb-b8fc-d62e5a5702e5
  6 2dc21671-f022-67a6-aab7-b36fb4a2c03f
  7 57e48048-18be-4480-a952-e9f444f6bd1a
  8 cb42b238-9815-4ce4-bfe9-4d327f372a4d
  9 122ac316-63e0-6c76-842a-b223cd7975e4
 10 4180a1b5-af3a-2a50-8c21-53ae90d0c3e4
 11 6edefa4e-d5a7-1095-91b5-ffe5e53119ab
 12 1b59913e-9819-3ba1-b360-45ee2369010c
 13 4b061d98-6258-2135-864d-91b36d890bd9
 14 3cdf1ce1-8e5c-3e24-aa1f-36109d9be215
 15 fe2a119b-a79a-1cba-9354-0712f2532f39
 16 57a57c47-70c1-685b-9dbd-77766d2f1d4d
 17 c30e44a3-5805-127a-a623-dd0e2e8b9d8a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 62838644621323161. Exactly this sequence comes out of new Random(46).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. Grouped in w2g3v: 4 hourly posts before runs 11/12; undecided: candidate seeds 70,597,546 / 2,764,093 on a new boot after run 10 stopped, 2 hits vs 0.51 expected; run 10 boot excluded
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related