201207060506 w4elt

explained decrypted filler

seed 258

Metadata

Post ID: w4elt
Title: 201207060506 → 2012-07-06 05:06 on A858's clock
Posted (UTC): 2012-07-06 09:04:49
Timezone: UTC−4 · title 05:06 against posted 09:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 11
Filler GUID seed: new Random(258).Next(9) ✓ verified
Run: Run 12 (seed 36,542,234) (seed)
Draw: 18 · predicted N = 11 ✓
Machine boot: 2012-07-05 10:25–10:55 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

8179793AF9D566CB 952F979A99EF3086 42123E2687950D10 BD3C85FDDD195B11 C162CDC44D3176E1 74C448C7631A6727 099D4272B73B8778 0AFE9989D5E4DEF1 667EF8E4AC6F05DF DB19213EBE0ECFE8 FCB43C5F3A43E744 4CB1F09CC91054BD A6402A9F16E93F05 D4D59B77CE6CF819 60E0CBE3CB08F1D0 F49D2A4AA009A1F5 299CD5C9816D4392 6AF3E50C8B32C787 C361EB23BC4F3BE9 BFFEDF3543CE64ED 120FBA9AE418320A 4578A4F6F0EBBAE6 CBE3CC1AC893ACBC 608EC714331FF497 9B7F04FFE95849C0 DD3284D4AC4313CE 598094087DDE6B1F 8FC38239BB51F289 B47E64CFCC622A42 D4AE5A994DBE91F8 8E20C900C00BF2CE C046B308B239071F 9A39938B6F3BD3F3 2C93B6EF1C128E36 CC8724711757A6DE 007FFC61359CBDC4 12F2B08545445120 2B9DE96D365E0DD8 2BE34BDA03DE3F44 D07442EF3875867E 7905D46E73063FBE F38182603D96FF58 9140EBC79FB49B30 B95112FA77EB1EAE 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3ef987cf-7a8f-47af-b5ac-2f3e432ccd71
  2 0b0d0c91-bb52-4f2d-9acc-5a00658ff5d5
  3 22bd3eaa-39b5-0044-a6df-63ab003682a6
  4 8513709e-d8da-5fa5-904f-6c38f21ce3ed
  5 3bafafb2-3788-670b-a16a-113b1aa25dfb
  6 c5ee67cb-a0c6-07a3-9988-59b91e44b92d
  7 71468534-f10c-4291-873e-43f25089d22a
  8 ca94b798-092f-73b6-9339-b6fb94551523
  9 b1f17694-18bf-82b8-a511-03fa344bc775
 10 d64a6476-4e82-3670-bc64-9245124f6173
 11 00b5b624-62db-37f8-b02b-f4eddce4bdb2

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 44056047833. Exactly this sequence comes out of new Random(258).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 18 of Run 12 (seed 36,542,234): new Random(36542234), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 10:25–10:55).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related