201207071036 w5q63

explained decrypted filler

3DES(name) ECB, 11 GUIDs, seed 892

Metadata

Post ID: w5q63
Title: 201207071036 → 2012-07-07 10:36 on A858's clock
Posted (UTC): 2012-07-07 01:34:12
Timezone: UTC+9 · title 10:36 against posted 01:34 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(892).Next(9) ✓ verified
Run: Run 11 (seed 37,057,156) (seed)
Draw: 29 · predicted N = 11 ✓
Machine boot: 2012-07-05 09:16–10:46 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

D5F59B5DF2EC64BB DC3925F6F716169A D8774EB9DEC9D640 E5F5626E56282BEE 8CE8759C50F240E4 A38E67E100FCE731 075777946EDFF2F6 81E98D33ECAFFC3B BF516C3FE6930C7B 936E433019D5BBBD B79B0C704D4D2DD5 1CA627CBA7BA7F81 488FAB5646038725 75A49BFF9F8BE41E 6D5FD73A9A8B0C8A B69E1D578832B730 4D9146C6E3BCE0E7 77CC98676B05C0E4 EA0D1C0B6B4CB40E C3E0EBEEBE8C85D9 70111D932AD24569 B0B97BDC02D6FB04 5B905E8F1C5A4A71 4DC40A8EC9D6B16A 0AEA07246110B653 49B0B21F8289F42A 5BF1CE30AE836E7D D51A63E06859FC0C BF59605DD2F26963 044A9657C702D926 23B3442688EECEFF CFF6C20B5D80D09E 4E8DCCC93601AAAE 5B050FBB5FF05289 FF269A13F4DEA2F8 2555679556967350 BE7FEDEFA06B5F6B 5718A6DC8DB34827 BFDA661AE830C11A FC215EDD291875C5 647DD4CEF479BFF3 0B9A2A8FD2610E40 5D5C076CA785D03A F4602184D49B203E 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 43445a23-334b-6479-a2c6-c1a9de7dcad9
  2 34c5666c-ce4a-4250-8e90-ad413346758f
  3 d4bfbaa8-3399-2be5-95df-e2c0cda5600d
  4 3145adea-5bed-8d36-bfcd-586a01a3391e
  5 d56b2e12-06d0-83dd-90ee-c52ce486c49d
  6 ff000c1a-0756-0efe-96fd-a10d67d8bb33
  7 254a6d84-0a1b-5f6e-a2cf-ca3dfe89158b
  8 90d5b537-4d96-8597-a591-f601e2b0f254
  9 815d89d2-a238-255f-bb70-67fe9c7a7b36
 10 a25a8cdd-a0ab-1528-a818-0c1e5743e61f
 11 3801d65c-832e-4e2b-8403-276d6adb6003

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 64288058214. Exactly this sequence comes out of new Random(892).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 29 of Run 11 (seed 37,057,156): new Random(37057156), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related