201207061809 w5fl3

explained decrypted filler

3DES(name) ECB, 12 GUIDs, seed 561

Metadata

Post ID: w5fl3
Title: 201207061809 → 2012-07-06 18:09 on A858's clock
Posted (UTC): 2012-07-06 22:07:21
Timezone: UTC−4 · title 18:09 against posted 22:07 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(561).Next(9) ✓ verified
Run: Run 13 (seed 19,267,593) (seed)
Draw: 3 · predicted N = 12 ✓
Machine boot: 2012-07-06 10:46–12:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

FE43ADE1D3135C09 5AEF04D2A1E1A986 7EDCE3EFBA228B39 8B8F17EB75B4339F BE427B6D4FBDDAA8 E77DA90381A79475 64689D67FA94E1D3 7E0BC9C06E9AB37C 5AB85BCFDE3FB205 11F7814323741AEA C51B97BA2C997D6E 655D664D31351D29 68DDCC021CB95B8F F143D21BC1C9B5A3 436430DA15567EC0 195EE88767ED70D6 EB3934AB56675482 93349C69ABA169C7 D8CE8F9B1DBB178D 7A97267667C53364 43334DAC7F5ACBC5 D2A65D8DAB3EE346 84E3A37965E84F58 21F5F733061447E7 02AFFE35BC114F2D B36EAB452BEABB6B 5BC9E787EC2FA612 C586FBEE02046BAA EF34B854DE2FA684 7B25A100F11DBDDC A93F586EEA2B121D AE834C2668C573F6 ACCCD4CAB9CCEDBC CA467029ABE7DB1A 7D2F5CC13B9722CC 83B901533F6BE4B4 7CAF783453703239 6E6C494820264153 9A9C1376A4004CA6 D15A03F440C33E8F 6DC5E833C0D399AA F3C68C24DA3F87AB A6FD610F97C7344F 91CDB10248FF2036 3A992B01E7710683 93B5AAC24BEB6AD6 13C5ACD6A959DE42 F48F4FF07A2E6C56 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2b3a26b9-61b4-756a-97b1-a48786575116
  2 3e38f0e0-afaa-3016-b9c3-0165bb1fc406
  3 80debd80-60a3-875d-89b0-fe6e74fb62f7
  4 8ad731ba-98fb-2cf8-a8a9-72f1b3a7f3c6
  5 ed6baf1a-fa29-4d58-b0f3-bf93c84e43f7
  6 952aeacf-3421-7cf3-81cb-b3ef69203c03
  7 d8c095de-6406-2b4a-a537-77c1bf0bf8e2
  8 7360c611-8fb2-72b7-80b2-321396bf5f12
  9 73b1aaec-c02d-371b-9527-e617c21745f1
 10 f7e8fd5e-ee0c-1f36-9e70-1fae78aa03b0
 11 464dbac7-5913-5f98-8d69-038dc7f8561b
 12 7def2954-d135-4e95-8105-3a61f37c54d1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 738247273154. Exactly this sequence comes out of new Random(561).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 3 of Run 13 (seed 19,267,593): new Random(19267593), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 10:46–12:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related