201207061936 w4gmy

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 813

Metadata

Post ID: w4gmy
Title: 201207061936 → 2012-07-06 19:36 on A858's clock
Posted (UTC): 2012-07-06 10:34:04
Timezone: UTC+9 · title 19:36 against posted 10:34 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(813).Next(9) ✓ verified
Run: Run 11 (seed 37,057,156) (seed)
Draw: 19 · predicted N = 10 ✓
Machine boot: 2012-07-05 09:16–10:46 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

C2FDE049A1D94058 2DA21F6E05334BC5 F29839ADFD3CA8DD 1C952EEC9AD8B76A 7A89FF0E7A2995FA 15091AFE52520ACB F359A0DFE6FA314B E9397E8598E1E9B5 DBF37218165EBB2E 62E0A8A669E5CAAB 7DE4D4C807ED6D44 26EDF3BC7CFCE441 D6EE6C106F09915E 0283F05C1936CEBE A98B81F4BEEAC487 0B2C0DC4B635559A 3B6588DA2E01B5F2 5E8A6FB0028AEB66 D63FC2CF5F27F89E 165789CD8A7279F6 AEE17530ECA9800B FECC809B6534BFFD 3B5A4FF5961908D9 36261C4D0976D99A 842AA8D46EEBA294 B9F08A883BEF73CC 28354AD96AE9FF42 6D5C37DCB91BBE98 5A14D2C8A8FB8ECA 5412C1F87AB60A23 D9C4FF9906D4FAC4 E0FC9F622950C3E3 9B8DB7BDC8F44999 DE0310FF4AA3EE5F 862540A363BCC613 80921C8A89321A9C 10992C18ACB745BE 407F800ED691962E 5D2B86272539D476 54A4E4A5D2E7E71A 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0f2b8b7d-57e8-47ab-b00e-ff6292e35399
  2 a539b5ce-e542-30fc-a87e-1afb23a58302
  3 96e958a7-9dce-0d61-881a-312d0ad910ab
  4 52a2aa9f-987d-06f2-b4b9-3f9974767551
  5 727ddab5-b10f-2622-a149-b8ba9da9edd4
  6 2c8d3204-cdb3-0151-9924-102c2ff05b93
  7 37a285d7-2cf8-1214-9701-b1b1338e7ff3
  8 fbc18cd5-a57e-2f74-b025-83c3796c7bae
  9 34e5a2dc-2c42-51ac-bf6d-f492a2581adb
 10 5b3d7ae6-dca6-0885-a1f6-eab5e839f677

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4300201250. Exactly this sequence comes out of new Random(813).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 19 of Run 11 (seed 37,057,156): new Random(37057156), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related