201207080006 w6gyi

explained decrypted filler

seed 329

Metadata

Post ID: w6gyi
Title: 201207080006 → 2012-07-08 00:06 on A858's clock
Posted (UTC): 2012-07-07 15:04:22
Timezone: UTC+9 · title 00:06 against posted 15:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs: 10
Filler GUID seed: new Random(329).Next(9) ✓ verified
Run: Run 11 (seed 37,057,156) (seed)
Draw: 38 · predicted N = 10 ✓
Machine boot: 2012-07-05 09:16–10:46 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 3
Tags: automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

B50730C868CB11DF 366ECF55D0EAAC0D 8AE5A926D132910F 3EEE527EA2949D05 D23F4468C47A617E EC60675B374F498F 976A6F391D84A912 1725252B79E55E1F 27B99A1136AFA7AE EA83A17471B7C69D BDCF32E7F699812F 561124F6A12F0989 B9016967B0E21DE3 09D5BBD88AC8A109 0D5627493DA1FDBC 04360CEAEFF0AD80 A973BA435E0E7E6B 737D85FB1DA334FB 27D2819C695C0823 81A6A209DBAFE415 A48A90A234906930 31423DEDE5996C94 997E78BF81E7BBE5 1D4C4EA5540F4CAC CAD5E84CB8A7A427 EF37A1DDA646EA05 91CB9F93128CD856 AD4BDC9497A7B78C C92B6FA8B74CD521 B3A7F9A765098F92 0CE1DF5F7753EB96 B93B3759CE8C5151 72C26C739E90DF40 29A2E4E9826049E9 2A105795C9753A71 F03A2B335A20C902 7FD49BC37C77970D 0175A729AEF07799 BE21D5F9863CA06F 5AC4800EFEACA05F 5DACFFBA8FF64DBD

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0f750be3-0ba0-5965-a856-f1a2b7f6e2a9
  2 ec796011-6933-374e-bd31-aa87b8129f88
  3 16e20e42-2de2-60f3-bb3f-baeef8827419
  4 89f40e66-8368-75a1-be86-537fca8b9197
  5 badb959d-49c8-60a6-a853-f20a559db801
  6 58befba6-3a52-0da4-9dac-dcbe5403c609
  7 dc0a688c-2a45-23c9-a286-c619f4006eb9
  8 fab29ceb-6bfb-4d3b-a1fd-926708ec41d2
  9 484d45eb-b7e1-6612-9323-12b9016cf13b
 10 5026f0c7-164e-5e15-a086-38660a1ec6df

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5367602465. Exactly this sequence comes out of new Random(329).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 38 of Run 11 (seed 37,057,156): new Random(37057156), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related