201207061005 w3t5z

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 64

Metadata

Post ID: w3t5z
Title: 201207061005 → 2012-07-06 10:05 on A858's clock
Posted (UTC): 2012-07-06 01:03:53
Timezone: UTC+9 · title 10:05 against posted 01:03 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(64).Next(9) ✓ verified
Run: Run 11 (seed 37,057,156) (seed)
Draw: 8 · predicted N = 10 ✓
Machine boot: 2012-07-05 09:16–10:46 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

946E2C8830FE71C9 3F1672A48CE3C2EF 530BE408E06D0624 F6BB717D1D884ED8 F97AC197AFF323DB 3989C9E41E20FCBB C4A2E565173D502C ECB7E28868ABF4A5 91190125C03D6736 94A5E823C94B1E01 9E293D4C401CDB01 E8DAD5B73A85352C 4014B7B4E45B7991 D462A0E0D01305B5 29985F7A85558152 3F0E250F5EC1FF27 D7895B1101F38558 106CA62D059AD65B 5F34EBF6D5B97D27 1B31350F43E092CB 2B34D47FD1C25A5A F93ED2BDD70404EB 08F8A47D98DB25E9 57CC5670EF665A9B DEE37B79F7899862 C9D1578293FDF239 B2B0F2B4FAE69CC2 E45B87581D1190D0 EB875A324C586526 12B0D1B1A1ECB7A5 43889E10D0E2820A BEBBDE1B31E522FD 15A81F5311F4C18F FC4B206B5EE79AC5 B8058D5F9165D226 9DAC2A5A3ECF3A9C 8F11F8CDC5AA8189 40776F9308B075EB D59E2B3B60F8241F 410B81D42916A293 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 86980fd0-ecfd-172a-a25d-d00659385f52
  2 441068b9-8e32-5902-8d7e-4438c26aa499
  3 1c2051cf-23c2-405f-baa4-9bf78b9054af
  4 37894a00-8752-1a6d-926d-f84587e549db
  5 08242e8b-fba7-0cda-b809-037a345fe435
  6 8068fefd-69b9-4975-9912-a2f28c150f18
  7 b8c9b22d-adac-5c3a-b28b-409e05ff2184
  8 37f3a442-93c2-4aa8-8d18-3220470f29fc
  9 9f5a36d4-384b-8faa-a9e8-c19dd4ccb084
 10 889fc4a4-ca89-7168-a68b-1144d93dadf6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1541045487. Exactly this sequence comes out of new Random(64).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 8 of Run 11 (seed 37,057,156): new Random(37057156), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related