201207061805 w4elb

explained decrypted filler

seed 860

Metadata

Post ID: w4elb
Title: 201207061805 → 2012-07-06 18:05 on A858's clock
Posted (UTC): 2012-07-06 09:04:03
Timezone: UTC+9 · title 18:05 against posted 09:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,232 hex characters · 616 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 19
Filler GUID seed: new Random(860).Next(9) ✓ verified
Run: Run 11 (seed 37,057,156) (seed)
Draw: 18 · predicted N = 19 ✓
Machine boot: 2012-07-05 09:16–10:46 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

7830496D5FB99C3F CD774A64DB374E67 154DD15F33551852 00963CC2655403DD BFE09261ED3F4634 47AA3E271C0CBCF6 068D40595D046CEC FAC89E0353745945 C063D9BE3EBD4775 573BF8D185344143 C6001E4E0D753D94 7F34B503FF0AEC33 9005E6ECE6DEA14B C2B2FD4BA34E04B7 9BFF75DDD51C1723 49E3E44BEE66ADB3 A893747BC2A7DAA6 593F54F1D4D81538 F39C354D7BEAD6EB E60D43856629EFCB D35BBF021DC4D1BE E748371D1A3113D9 433BE2AFB0856396 7559C13FEC9E8F22 4B42C42DB98F742C B99DD41D09679F44 74B782B7FF3F29F7 B931F9510D8AE879 81CB9A4D74094665 BF1B7018B45AA180 2F8E529700E58B84 183CBFE8AE8CB660 4F6D191B2B6E6C89 F02AA3132A35AE57 046CA31DE7AE1B17 462CE58F99CDE1A9 E8B26CF8945EB471 100B1D452CCBEF6A 33FF728F96FCA0B6 0DFE9F60D50DE64F 8E5C2EF0881ED8F0 FE936FC0B4DBBC7A CC4C4056BC562877 D7336D4DFD295B9F 565F0DDAFA4A547E 248DC17952287434 CA194FAC3C7C60DE 8C189C3ED7715DBF 39A3EE895A053464 6409A3B3A4596BFD 4BE67503792B0E66 68F35C53FBF1D2DC 734C0BC33D631251 B08448B1504DC9E7 F151A451D38E2091 1FA6BE097871A19C 1A6C235EE60FB264 CB6392FC8D1ABC8E 8E65A31E0F7B2A8D 77C306B4480B85EC EAF57A4B35258672 96531D57C480176C E17F7D4DF696C915 4C8B448B693E0334 F2AD4B42491245F3 7783D1485C979163 BCCFA6134CFD0C0E 8F7E72887452D35E 0FB736591155976F 125E4440F05D8385 29BCA0D4E2314B49 52A002F17C67FC70 E8BFE1E30AE9B30F 84631FFAA036DF93 3B25DB1EA57779A1 1DDF29BD3124B9BC 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 1,232 hex characters = 616 bytes = 77 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 19 GUIDs as hex (shown below).

Decrypted: GUID list

  1 521c4c01-db39-04e2-870f-2433e6063fb0
  2 f465b0fe-e7be-14f5-ad5a-930c40c8a404
  3 b97a60df-bd9a-8ed9-9954-6ebc73bbd5d0
  4 48c784a5-70b6-17c8-9738-d376e3de874a
  5 c4a1876b-a921-4de9-a157-7cc38bfb68de
  6 2d363bc1-a0ca-0a4b-917a-2f3c35d00113
  7 0d431709-74fa-2edf-bcff-b11aa00ab6e5
  8 c3e80341-caa1-8534-b593-16b0e8979cc9
  9 dd890d4f-c8e8-3347-8293-a7c577be4804
 10 465054a4-70ef-3e9f-b1fb-712c3dcb51c5
 11 f5d4509d-a457-7b63-afa4-4bc361b1209e
 12 5f4a3158-f61f-79af-86c5-9992cc758e21
 13 4f66177a-1ab9-73ee-9694-055a9946badf
 14 63e4e7a0-8082-8541-a47f-9738140f0d08
 15 107ee075-b449-882c-b567-cdd837596865
 16 ac55403f-9f7d-1732-8c3c-61f14552ef15
 17 77eedd50-14a3-3181-b1ec-19d3710a56ec
 18 90b02d48-7e20-101f-b086-757fa6f65812
 19 0d92cb3c-3c06-8ec4-930d-fc95788b86f5

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0181402833777881318. Exactly this sequence comes out of new Random(860).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 18 of Run 11 (seed 37,057,156): new Random(37057156), Next(8,64) per post. The RNG predicts N = 19; the post has N = 19 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related