201207070139 w61ta

explained decrypted filler

seed 797

Metadata

Post ID: w61ta
Title: 201207070139 → 2012-07-07 01:39 on A858's clock
Posted (UTC): 2012-07-07 05:37:26
Timezone: UTC−4 · title 01:39 against posted 05:37 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 8
Filler GUID seed: new Random(797).Next(9) ✓ verified
Run: Run 13 (seed 19,267,593) (seed)
Draw: 8 · predicted N = 8 ✓
Machine boot: 2012-07-06 10:46–12:16 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

70F0BA2F0940A397 4D60EF54BD835BB0 5D90EFA542B18B72 17A4BC78C31D4D42 A6623BC47C5BD3BF 0CEB52979270701C 9D5FBBD390029BF8 B2808B8D64EDFBEE 60591F4CF38CE196 FE8D28B6BBC04437 BC5EE2DB925D385E 67D530B6A3BD3A4C 5E44DCA438398E76 DBD4C01C6EA09436 C98C7203141AAE0B E0515207A85691E4 2922A2B8C5D57337 6F6ED7BECA7F824B 8ABFADD5DE5C72C2 9E1CD98A361BEACA B09F4ECC952AA05C 58158D2A5CBCA43C C532AA2A95215DA9 1280759A35CC65A0 260F14BAC6FDB6D6 441AEFED4E6EB04E 67CC38E261C68923 ED11C5870E78FF41 7C1D4FDF3205B5C3 0DBF2E05B6B48748 D364B22FDD2AF88B 5B2D092743E77CD0 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 825c51cb-7de5-0e1d-ac01-b2a837377384
  2 173dbd78-c7bc-6388-9b88-e4fefb8ab884
  3 f001a8ec-f123-7c1a-97e4-a0821f38852f
  4 e00485f9-3c71-6b65-83f3-3eaea4c0994a
  5 e8a6a020-5e29-0501-b008-288d4e9d39bc
  6 27528998-daa8-0452-bbc2-aa093d62576a
  7 21a9a5c0-c18d-0b8a-b436-2b8dcda5fc27
  8 28b99a1f-d089-21a1-9391-c3f871ca9709

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 06760002. Exactly this sequence comes out of new Random(797).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 8 of Run 13 (seed 19,267,593): new Random(19267593), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 10:46–12:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related