201207062236 w4m4e

explained decrypted filler

3DES(name) ECB, 14 GUIDs, seed 829

Metadata

Post ID: w4m4e
Title: 201207062236 → 2012-07-06 22:36 on A858's clock
Posted (UTC): 2012-07-06 13:34:06
Timezone: UTC+9 · title 22:36 against posted 13:34 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(829).Next(9) ✓ verified
Run: Run 11 (seed 37,057,156) (seed)
Draw: 21 · predicted N = 14 ✓
Machine boot: 2012-07-05 09:16–10:46 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

44339C195B82E51E 3BC61C66893AC19E 1B3E9DB5830CEF8D D7682E197D0D8B5E A3EC3EC4C3991F09 E2711C2A5D9117C6 85AC59415B9D0346 6DF1A71493855006 B445B3AA5AD41042 1DAACB932A39D4EB B8159D69290894F7 4EB54F742D2E2968 9F2D290F8DFEFDAC 9D392C4310BDD181 F0DF1BB739118DAA 923337E9260E4D98 2DEE1B71A6C079D5 CC5DB5B2E6B65DD0 DA5FC66A0065366E 2EFE290D678D1EF2 AEC5D363BEFE1FAB 66C586F200399571 D8124711120AE03D 091B3C2497614E1F 6F6FDD603DEF5C34 6D26AD8C5DFB8F43 4E611D17222FF29C 740D97592C35CB62 2620300469253C25 61734E62B149DC61 1B67FCFE34B5D5B3 1F0CEA84F7D5E5F1 CCFD3ECAC3012A65 A65EF25E88A7B487 98F6B343B2A265C5 E97D7B919C88443A 41593D5288E22449 4450A89C9A564535 672289A9B03B7319 1642363277592F7B C81FB1455B9E0215 1D8047DAF2474770 460785C4C11B2368 0DBB8BCA7618E7D0 EA8A1110C5FC4115 9F67DB535B0F5C88 FD1B59677C660841 EDC472F0BFE0C4AA 6626942FE76ADB3F DA2DB0EF20A5F953 8B061C41FE5712F3 D733E8C7124C24DC 272109860C6C530B EAD0E6BB0FEB5929 D7BDDD571EFD9827 F143778085634152 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9bf7d6ce-3ef4-791a-8ac4-e505609a27ea
  2 a6347aa5-6d1b-008d-9b95-bbf6f087f863
  3 7b379e4c-6dbc-2072-bd89-0e4511cad872
  4 ffd132a7-7f15-428d-b379-91dd99f83921
  5 25671aa1-0cf7-4817-b902-7387dda7d450
  6 5e794a99-6415-07ba-80b7-6c0caa5ddb47
  7 cdbb3f96-fc57-3948-a206-5eea92d21492
  8 4de7f743-6fb0-3f99-bd48-44e651900f65
  9 43bb6e52-e7c9-4d13-9c08-85b5ca46bb4d
 10 bb2a32ac-e50c-88ad-9c36-563303efe845
 11 209daac7-6c24-09cb-bf07-b6989dd637e3
 12 a8403f13-67bd-6974-89dd-071c231c1463
 13 560f1e18-660a-40db-a766-4da732a14a0a
 14 0d4a3a58-0194-6c26-83ea-f9ea6bcc6602

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 70244033480646. Exactly this sequence comes out of new Random(829).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 21 of Run 11 (seed 37,057,156): new Random(37057156), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related