201207061235 w41kd

explained decrypted filler

seed 704

Metadata

Post ID: w41kd
Title: 201207061235 → 2012-07-06 12:35 on A858's clock
Posted (UTC): 2012-07-06 03:33:58
Timezone: UTC+9 · title 12:35 against posted 03:33 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 15
Filler GUID seed: new Random(704).Next(9) ✓ verified
Run: Run 11 (seed 37,057,156) (seed)
Draw: 13 · predicted N = 15 ✓
Machine boot: 2012-07-05 09:16–10:46 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

C6FD9B74FC1207B9 135B940698758175 D64E89F3CBBB4699 BAC7E2AD88770E9D B5C50EBEC9BFF07E 936A4636C682569C 4188272B2BB20A43 6B6045DA716CE4EB 255258A975C3BD92 35C1FCF1F942448C C1F63376EFF989ED 287498B6530A75D0 166F9DEB5F39DE74 F15F7561C9DB3C93 BC467FFB290741C4 7EA7A5D1658F636F 31878E93ABD1FB0F 4D43D7D3E9EB3A57 9E5CBB777315C242 1C9582270E488F85 7FA5E87800401F99 C9F7B44D5CB5FA7D 7E8D1AE582414F41 1BFA82A86AB303F2 0563C8800424353C 15430879451473A0 0D4A655338BC6024 C7EC06BFA3365EA7 FC87C1EEFD5A64AC 2C7CE0E5B9CC134C BD67145DDA6E675F C5396E035E50F5DC B04E36CE3874E859 450B65C036B5ED43 CF98B399A931600C 09BA0A36325A4A1E 58C8951ADB787358 097CEACFCB26A731 3519C1AB1526CEEB B64173CADAF14FF4 449022FFB7079470 FA205E1EB92D4013 79EDC39811AC7F4D 1DF5001EF633F333 B8F2DA765F38CD77 D62A84C30436FBC3 22A7F3BE380C2697 536ECF2E936D9888 E69F59E0184F5252 8D9CBADC768CCE79 433A10452C06A3EB 8A0D9EE0BDDD8B73 D1DD95588B6B8BBA 5DDE36F48B914840 C2DD4B1614C814FA E969622005C37B45 A938B190B9D200C9 660B22D7C27E7527 431691E6C7AC876B 4EF9E1B279C86B65 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0bd381b5-6c32-4321-812d-fe56940598c9
  2 7f2d90dc-d55e-37e7-beca-513df6f2c655
  3 29cfe6a4-bc8e-7e7f-bec7-1761d75bb174
  4 87005357-8bc2-7418-b9a5-d4ad82a8f3a0
  5 98a8c8f7-e743-05d8-b61a-74fd04fb9162
  6 fd66a4ba-4481-788f-b7a0-ad7dbe64b099
  7 f08e8fbb-8c97-3372-8360-3978f121b778
  8 cac55d97-1f42-55a6-96bc-7f55557fdc6c
  9 07d9e41b-fae2-0f86-926a-da3fb14ee1a8
 10 a204d23c-b954-7e4c-ad5a-37eb946f1cb3
 11 dafbf0b5-17cb-8951-9d21-a95da3332d68
 12 d1577427-48e4-0e55-90df-63624a48de0d
 13 2b37baa9-c331-5132-aa05-f4662927d7d9
 14 aa5bb0bf-5f2e-69b4-b099-b16d55f5bb5b
 15 39f5e32b-33fb-61a3-85c1-6faaee1b798e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 437707350780566. Exactly this sequence comes out of new Random(704).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 13 of Run 11 (seed 37,057,156): new Random(37057156), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related