201207061339 w4z4y

explained decrypted filler

3DES(name) ECB, 10 GUIDs, seed 672

Metadata

Post ID: w4z4y
Title: 201207061339 → 2012-07-06 13:39 on A858's clock
Posted (UTC): 2012-07-06 17:37:19
Timezone: UTC−4 · title 13:39 against posted 17:37 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(672).Next(9) ✓ verified
Run: Run 13 (seed 19,267,593) (seed)
Draw: 0 · predicted N = 10 ✓
Machine boot: 2012-07-06 10:46–12:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

EE5D2CBEA097EB6E 4A3AC3F579642F0B 531F9431EE864FF9 94FD3F2D5CF97490 785F0F71DFA6AC75 3BC44045E43E4E49 CDFFCAF329A59E85 FA1E031BD2E4A5B2 DD7476CBA69F1738 951DE4935C705D9C EB4014758AB00CBD 01A8DE945DC77F79 229DFE819C3776D1 D01C64D700994B40 4F5DDA39090C117B 2EBEEAC97B1680F2 0FA10E7ABEDF0D61 1585AF495D88CEC9 88AA81EB621FC4F0 5C22FD79B184B00E 480A5C5CF035D530 13167BF110A381E7 4291841E37AED56C 1592C94D9BCE905E E3C896788199E29A 13F50CB830476128 8F952F47678247E5 B140229BD1452570 334C85CDB6289AB4 379155749305282A 091417EA17A1CD75 88170B6120AC2506 089CAD0ABC724BF6 5716BCD6E04B7A49 50FA958DA339A45C 0B971697E1FB6B1B F7B9EA5D5611741F 30B87C49F35BA442 24A1E00277D0DFFB E33427E0A18B99B7 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fce327a9-d08a-7b9d-a121-c7c1cd9bfd24
  2 c1324cc6-c5b1-8bb5-8dc1-4697089593b0
  3 23e8fb9b-620f-4355-b0b4-ed6d1ef39822
  4 dceadbf2-281d-8200-b744-40b6d5e30ef3
  5 bbff5706-41e9-52b2-818c-113bc46220e7
  6 84b8fec4-04b1-76b5-858a-f8ef71f7826d
  7 b2fd751d-bda9-0d7f-9f9a-0beb0513dec5
  8 dec02b20-c227-5ac0-9b5d-76000027e5c8
  9 dff9c241-e61e-1efc-99bf-d590985b3a70
 10 6d254170-be24-0acd-a685-2a47180c0e7f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7848570510. Exactly this sequence comes out of new Random(672).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 0 of Run 13 (seed 19,267,593): new Random(19267593), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 10:46–12:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related