201207072210 w7d4m

explained decrypted filler

seed 923

Metadata

Post ID: w7d4m
Title: 201207072210 → 2012-07-07 22:10 on A858's clock
Posted (UTC): 2012-07-08 02:08:06
Timezone: UTC−4 · title 22:10 against posted 02:08 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 18
Filler GUID seed: new Random(923).Next(9) ✓ verified
Run: Run 14 (seed 205,976,312) (seed)
Draw: 2 · predicted N = 18 ✓
Machine boot: 2012-07-05 08:28–12:28 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

282E7292B45A35A6 DBDC71B6CE16ED26 4884EE780B5C8637 A241967C512AC249 2380AA524398C298 7AA08CD7D3B3EBBA F4D8A5B9CB374848 DCDCB1EA2F7E6DA6 FAF5695A0FE4F672 2FF67F3C6D087DC6 D372A6EA8CD846AC C3BFD22F29C90670 B62A11003193A52C D32000575BE189C0 023B9A20CFF66D9E 195540517F45AD44 C28D17F2959BB1B4 82E1614CC76BAC51 E1D2B02724CEA3EC EB1C7ED96E2800F1 48ECB3328731FCF4 F3E24422AE2F721A A64C6CA3DEE49A35 9E3772EF5EDE625A E9D671C8D1176D74 8DA409A6152BAAC6 8214B62F6EE6333C 4D40297B8B41871D 8358247A1C32D286 D43DCDABBD4CCAAF 35273D8DCED593C2 EBC5A1AC46C3F1A6 7F2FF14683907754 E814E533256066A5 1BC52D697ECA9C5A 0237A4A2D475A469 33E8AF7FD515089D AE6545709F92A396 7F7AA76D67551702 7B50D82E1308A4AF AB17760AC53188B0 DE898F6A9215A1F8 B1DA4424A29E82A7 80133ED289D8D75A 14E28B75D3EC4713 1791E4B84CEA35F2 43902C876783AC5C 2626E3080770561D 5A5B52430974D498 7FE6B7958046F0D0 F40BEB1F8F665A6B 8ECE87B3D229F209 C25234E9EF95DDD2 B5D1142BD2CE842B AE2076D5FC563C10 FDADAF1FD6676BB6 C465800F848F7E5D B70D3069379828E2 D4DB1BBEE6673A5E 3AF99884297C617B 0694A3F27C90439F 37B00FE568EB5148 3CD609BBAD94CE9D 7D11ED27F3A4FC6D 02A3F4D2F8CF14A9 7331E8C31F63CE2A B0174B29FDA77C83 C7C17B17BF349E70 AE1BDD142238D860 56D41BF0AC6EEB13 398138842076C998 5DF01BC9395FB751 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 226e1a80-05ff-8705-a6ac-2893b4e1e92e
  2 3e04d030-6ce9-56cc-94fb-293a4fab4588
  3 c0e21318-85d7-8b94-b850-18f4b2afbd80
  4 d92b57cd-c210-5aba-9d41-48ccf30950c1
  5 5b10856e-6535-8d94-83f6-e12bc8d743c0
  6 a60aa89e-cefc-1159-9bb2-3cb1719395a2
  7 79735003-6f37-4099-8e89-a7126701619a
  8 5ae66bfc-1915-46a1-8385-62feb473b84f
  9 89d9bfaa-ec61-17f1-b4fa-21dde582dd8e
 10 f83ceea6-ab11-5149-b320-2a39d3a39504
 11 68c72577-6b86-2872-a6d0-2b2e14cf9c60
 12 4aeb5e0c-0bcf-094b-bcd8-cdf33201bef2
 13 22610436-ab90-1bf1-9e04-27b7f7abe054
 14 e0578c54-fb40-58bf-af3c-22254e7ab0d3
 15 d2a11775-ff6b-02f0-a2ea-9e2470804309
 16 58548077-4064-4bae-aa27-4eeecc00b4ed
 17 2115d43a-6f93-737c-97f6-dcec2e02d8c4
 18 b3a6de46-f412-255d-b971-244235899740

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 858581441520150472. Exactly this sequence comes out of new Random(923).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 2 of Run 14 (seed 205,976,312): new Random(205976312), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 08:28–12:28).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related