201207071039 w6fx2

explained decrypted filler

seed 5

Metadata

Post ID: w6fx2
Title: 201207071039 → 2012-07-07 10:39 on A858's clock
Posted (UTC): 2012-07-07 14:37:29
Timezone: UTC−4 · title 10:39 against posted 14:37 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 8
Filler GUID seed: new Random(5).Next(9) ✓ verified
Run: Run 13 (seed 19,267,593) (seed)
Draw: 14 · predicted N = 8 ✓
Machine boot: 2012-07-06 10:46–12:16 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

7BFC3403F52FB919 EB595E5603D7F3FC 92B772D565A98D3A DB8757E70DA1B972 E75F6C0D489D1A2A 170E2FD5ECEEF1F0 93763B2DD84A5297 DFF8D35E0684C883 EEA9F0333B91FB29 329E0B05ABA52D84 53464CFF2AF850DB EC6EAA7B16EACF9A C77510F051298D6D 22AFE7FE30135EFF 0B72E9CB34A78D6C 25061676003CC607 6DC2D554B1B06C33 314BA9760536220E 760FE527ACB34B54 FCFB9D59361DB8C8 BE9347E26BC63484 5711306E601F013D BA9575E23AE3AAA6 F267B9E5BEB283AC 3F2CB237E2CBEC2C E35A343AD2B2AC5D 1F79C4C8F1011CD2 AB46991375964BFC 329CB12B7C353975 2AAC6A85081AF03C 7D67EC22F128329B 5EB8845AC3DFA45B 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 28e3227e-afdd-38d0-8e67-028f94f61502
  2 d57beea4-8e19-226a-9482-cf4ddaeaf8b2
  3 af1f7c0d-f4fb-2834-9d98-3e59f90e1258
  4 fe82a803-8941-5e88-abbc-8aaa30223a6c
  5 fdf81beb-13d5-4b14-9cbd-f4d9af69b7cb
  6 b67ac3cc-5fd4-80d9-b0b5-c5c3f2f5610c
  7 b0604ac4-39a8-19ec-8a66-3b663d8d95d8
  8 d4e9c24e-1ea4-8ec0-bc42-1b3c05193586

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 32254818. Exactly this sequence comes out of new Random(5).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 14 of Run 13 (seed 19,267,593): new Random(19267593), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 10:46–12:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related