201207051836 w3ktb

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 720

Metadata

Post ID: w3ktb
Title: 201207051836 → 2012-07-05 18:36 on A858's clock
Posted (UTC): 2012-07-05 22:34:29
Timezone: UTC−4 · title 18:36 against posted 22:34 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(720).Next(9) ✓ verified
Run: Run 12 (seed 36,542,234) (seed)
Draw: 3 · predicted N = 12 ✓
Machine boot: 2012-07-05 10:25–10:55 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

5DFBBD7B5B0B6596 C10C725BFC27D63E 8A1550300B21BB2F 8F1E58F3F72E9A1C B874EA0D246A17F5 D53E93D6D4907FDB B3C6E63BA424AB3C 44BD019A62074E08 2C529F419484FC76 9A38394900DE88E4 27FDE9D0C68FC2C2 0E6E0AD72D59FC8F 2EB8CE04C8C8CAD0 C13E8797A00FB751 1E1ABDD1FC2416CF F74AE9EAED8F739E AA627B0F795EDB04 0A02457A287CD57C 44C6DB0A28880DC7 0934714CE27DB698 12F0C9992BC073F6 1FCC778D08100CBC 088F7DF98762889B 7DDC970D9E965D70 2E151F37A13A1F73 D25303F33DD8E05D 9F8BAE1AB9BC9335 CD0CDAFFABF8086A CFDAF02B0770D39B 432D10D2460ADDB4 DDC28A94D3DCB115 2C1E33406E26939F 426A9041111C5277 2A047F7F40A0C78D 29E17E77AF7166AC 2329F4D254CD6CDD 03DCA9596D3B2E59 1BB7D0C16003E0EE 8C7124115E1DDEC1 DA75008DCDB282BB 3F7708E8C27858BD 50E335E8FF6C00E7 0E95E073A8F8B6DD D4F88D6E8FDA230A 3084785EEDE79C5D C04B99352A7989D8 B9BF1D6A07C27567 9C3E0CA295BD3FB1 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 586235db-208c-7462-8e9f-46fed5361f21
  2 eabec764-a9e2-0ac6-b49c-7d08e6d8895e
  3 dea80663-a11e-0e79-be0d-167d87dc862a
  4 f60b5e34-ce6d-20c0-bc97-626acda1b365
  5 3a051db1-c384-2550-b2a1-8e00e2e4d441
  6 2ba16f49-9a2f-6c69-a8a6-d47f9d8f192f
  7 deff85c1-55e5-47ed-9096-059398af574a
  8 12846898-7431-50e1-a224-7c5124fd830a
  9 e7a966f3-6442-0738-8856-4a5160e4c4cc
 10 74f0c562-8bb4-6773-8289-509db530edd1
 11 872dc064-b5db-65fa-b85f-333de0f76af4
 12 29b06f36-4ed7-58cd-8082-f2209933f05a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 700226450665. Exactly this sequence comes out of new Random(720).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 3 of Run 12 (seed 36,542,234): new Random(36542234), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 10:25–10:55).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related