201207070006 w4qe3

explained decrypted filler

3DES(name) ECB, 9 GUIDs, seed 735

Metadata

Post ID: w4qe3
Title: 201207070006 → 2012-07-07 00:06 on A858's clock
Posted (UTC): 2012-07-06 15:04:06
Timezone: UTC+9 · title 00:06 against posted 15:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(735).Next(9) ✓ verified
Run: Run 11 (seed 37,057,156) (seed)
Draw: 22 · predicted N = 9 ✓
Machine boot: 2012-07-05 09:16–10:46 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

0AA8438AAE05C1AC 4414D380728C01C5 E6152F2A47DF3574 02ABCC3A3D3CA548 BBD36CF0F0515348 A089B04609EC6AA8 E43D4977222CE5D5 C71E7F92DA486FFB D310E8CDE366C8BD B54EC766ADD41473 9D331D4346CE85DF 542FB4E86BCBF8D4 8A762C89D0159093 50EF879B800F424F E4C175037477ABDB 15E2010484177D1A DD1C0EEDD9E27DAB FB28A9EDD97704A1 CE9A220372002092 60913F8E64053668 AA7CE2D566930A4A C51FF3F73D30D544 DFDC6C929A59C71F 50619FEBB2AB593E 0EB4FDDAE9976BD4 335BCC597C6A0C28 B219803CE1E62113 5CB1AAADECC69F80 84781D02378F5D3B CD8B4F169712F3F7 F6FDB8FF759DC612 43B5AEB35EAA61A9 166B7F5B21CF0BA3 9E9E48F8D927DFDC E16386CA3D35A4DE 5D36DCAEA3ABDF12 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 af257dba-5678-654f-8afb-43a01fe58d90
  2 d0ffb0b1-38bd-4b52-908d-ed630156958a
  3 0c43a42a-8e7c-4261-a4e2-e0fec060c3fb
  4 65c1add9-8d01-386a-8fb9-4c9dbcd264c0
  5 9c982dbf-67f9-019c-95ed-fdd15d972260
  6 5e902bd5-f8ef-7767-9a25-8aaf7bb40a1a
  7 3f553ff7-cebe-2f76-a2e2-c0a840d57138
  8 7cf4d0b8-0342-1cb3-bdd4-b8fc72789818
  9 2750aa1a-8966-8433-b5de-b4e0f7d87e79

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 644307218. Exactly this sequence comes out of new Random(735).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 22 of Run 11 (seed 37,057,156): new Random(37057156), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related