201207052306 w3zv4

explained decrypted filler

seed 740

Metadata

Post ID: w3zv4
Title: 201207052306 → 2012-07-05 23:06 on A858's clock
Posted (UTC): 2012-07-06 03:04:45
Timezone: UTC−4 · title 23:06 against posted 03:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 12
Filler GUID seed: new Random(740).Next(9) ✓ verified
Run: Run 12 (seed 36,542,234) (seed)
Draw: 12 · predicted N = 12 ✓
Machine boot: 2012-07-05 10:25–10:55 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

DBF7AF5E3DB19F6F 0A5F280DC887565F 7848AF124755C854 199D3DFB4671CED6 1BE04626A9D3B901 5525D4D053A6E90D DAFDD46774FD0D67 185FAA997CA0262F F25B31F46C60B600 690654E3C808E344 798BFD806F95B56E 7103F02B86110A72 68BFA7320FBB6567 B9003F0AF2ECA1F1 BF9475CF72261431 F9335F56344D1F7C DBA5D66AFCB33AE6 CCE5226156DA4259 F29854F8E5EDC64C C708A89A306C9962 D88C685AACBC6989 2B313FA10DE78EAB D8D6C7CC6C38A5A5 F14684E5DDC810DE 6D53C750AF4DEE01 1A311563ACFC7225 0DD26B9FFB3E0071 081F42D091ED5613 27B03891C7D3BCA2 55DC536B4E83CBFF EDEAAF6704F979AC 4B17F60098D6C8E7 E09540100537C466 EF922B8F07E047C0 FA2C2C86A9592B6E 422CACBFBF1FAA74 A19FFE524879E80C 6B3AF18B01101FCE 630041D57F5F1734 8E2FCA87D5FE2FD5 B4B9B80026525C65 4929B5C1DBC398CF 485BF2ED7BAE9239 6C6B290ACF49AC2B CAEA45991256A2D1 AC146657E4BEF425 9B8A2FCA084E68C1 E3CDF96E5BD61E42 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 52a78de8-aa2b-271f-8e63-a1f1863b8b9e
  2 6527b1b9-5fa9-8faa-9aee-943f70264729
  3 c81551e5-6db2-077e-97a2-80d584cabdb4
  4 4a4db680-1b7f-45af-8bc8-64ab11cd9e8e
  5 4603a059-61e4-2dc9-8e2a-ddc73ec0de0e
  6 f9f8a56d-fdc2-2a38-a564-3c290275f61c
  7 f4cb61f7-849c-4767-9a29-b51540e6648b
  8 e594ef61-0107-6700-8366-b1d6d83533e4
  9 6e4ea0ff-a8b4-43a4-b0ad-7a3d6ffa06fa
 10 2be227da-d341-18b1-85c6-a4eec639c841
 11 3ace99d1-f5e0-4c7c-aeb7-90f9101ea0d9
 12 0edd403e-b5c1-1700-a10f-17a7200cf1c8

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 280422464141. Exactly this sequence comes out of new Random(740).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 12 of Run 12 (seed 36,542,234): new Random(36542234), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 10:25–10:55).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related