201207062106 w4ive

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 876

Metadata

Post ID: w4ive
Title: 201207062106 → 2012-07-06 21:06 on A858's clock
Posted (UTC): 2012-07-06 12:04:05
Timezone: UTC+9 · title 21:06 against posted 12:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(876).Next(9) ✓ verified
Run: Run 11 (seed 37,057,156) (seed)
Draw: 20 · predicted N = 12 ✓
Machine boot: 2012-07-05 09:16–10:46 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

35C529FB3DF428C5 8CCB2835F8770B87 80DAA0645C1C6DC1 C0DFA3BD737E790F BB4F2365590B2780 5503DFEEBF4D0C31 C04813AB64980E70 955DF53BE6B90AB1 70F9FE54FCD60B23 64B69FFCE62A1022 AEF8A55C08F0DBBC D0729D42CEE2E18A 4EB53F6657EEB9F1 BF1CC8C344C02AF5 3186FBF00C3FE16B 143DC2A625E515A9 31641E0639B84773 227493A48A6A353E B241F4876DBB57E0 8A41781FEFD2A448 F352697A94101745 9FDC00C5753315D8 E6A464E23CD03617 CB1344DAC3F8A251 057EC32D5DDFD6FF 212AFF8E71375022 12C56C19006C8411 6C27F88D515407C4 345310C0D97CBE3F 4FD3978BF3747DCB 66135DC314FA86BF FEDFD20E44C77D75 F328207231249636 363506546DB80496 6A2DC78D4AB1DB7E 7890C46F924594D6 E313E462175BBCD9 B8D7935106F03CC3 26C98007B901A482 D552C2C01EAB84A3 89DC6D208FE0B748 299422CD358B9CFC 358DA0F35CF3BF7C 159A025363A0AEFC A179E9211C527202 53C42F4D720612C2 E72DE8F6DF00A53D 73522DF841A034D3 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4c327bc8-3c9a-3d63-a73a-39b5c8c7131e
  2 89e2c33c-e51a-768f-92d7-0f1715f63a99
  3 3618751b-b557-04ab-8fff-75077aa7be05
  4 4eb264c0-d90e-41b6-bf02-7d00e1579c39
  5 4454f50d-83e5-6623-ab78-fb0618f3e356
  6 4b1b2818-3363-0db9-9db1-9e1d8bc34594
  7 614645e1-5976-3061-82f6-6ad499c3df72
  8 15cf1bc4-ed2f-8467-8e83-35d9084c90a6
  9 6b8c4042-9c24-3904-8b93-e40f78bf4d74
 10 c2191e7a-58a6-2fc5-8a55-bdeba8166f4c
 11 05bae4d4-f5d2-652a-93e8-852811674290
 12 8480e70e-f910-31ac-b9a0-33937e0bf1b0

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 370460383263. Exactly this sequence comes out of new Random(876).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 20 of Run 11 (seed 37,057,156): new Random(37057156), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related