201207081110 w7d52

explained decrypted filler

seed 114

Metadata

Post ID: w7d52
Title: 201207081110 → 2012-07-08 11:10 on A858's clock
Posted (UTC): 2012-07-08 02:08:24
Timezone: UTC+9 · title 11:10 against posted 02:08 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,232 hex characters · 616 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 19
Filler GUID seed: new Random(114).Next(9) ✓ verified
Run: Run 15 (seed 117,733,640) (seed)
Draw: 2 · predicted N = 19 ✓
Machine boot: 2012-07-06 08:59–12:59 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

BD991B21CB9D126B 357EBC08FC8DC22E A604D620CCDFE6FE DB3C9B7E5CF634B8 8AD1FE16107F1357 6BEB563DF1FE021F 28468EFCADD8BE76 25573B75BDFA071F 9581CC92D6752289 E53D872CD4B2EE1F 7A2F1CEEBFE87915 3A2F2B7337FF46FF 780EF99F54E1225B DA686650F787A13A 19AE4981D0CC0EE4 382DFB3F204F13B3 885F96D855F882FB BC81426B14DFD777 E4CE8032C214DB0E 413DFE770A0DD9A2 93B38582E9DC7832 15F41236BF7C6374 013F16C48123C7B5 49CDE75299EADEA1 396602425578C510 86860B6C690176FE 05FDEB5FD5D8B7B4 FF3CD7FAF34E712F 22B9F8067ED541C8 97CFF54559F43835 A56BE9D89D91BF5B BD93F6503E34269B 15407A2D9DD592B1 AB1F7F0C9C91551F 50723DCD008E2735 4DE5E38CA9C176E4 2511206129644260 FE309F67321F8387 7A0730F1A856DE30 507F3A287EB1550A B7300E0198BF3E67 9AB25D71E9B2AC59 E889FB4CAC531B16 E65CED56FDC02802 467D791EF705E06E 8B982B7CF1647B7C 8445E2927B6C7408 F0BFFD24B4E245FA 9728FA8357E316CC 76EE7E51EA59EEC0 E93BC19C2A029AF8 D7A5AC29C3A9F5F5 130A800BC0D3CCEE 914ABC411E5ADAAA 561B6DFEAAC8DB33 79B01D3D35EB79BD 93D46BCB2AD00A2A 23C43B4D3C464454 85EFF9C3F3CD6CBD 3B5E4986371C7D76 1998630CFD065470 7E8056B255F32426 58495552EC212C89 6BB71CEB144B3CC1 8B69AC3227425CD4 48F9C380763DE167 3AA94EEB79A8EE39 32E70512BD7880C2 938DC4F439A6DCB2 C8CC61AC9725346D E11838EAAB62EE77 29A985BC48A9DF99 FA10CB9B00B40288 8A7D29FEF55A2FA6 9754713A87C3566A D713E233650073E0 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,232 hex characters = 616 bytes = 77 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 19 GUIDs as hex (shown below).

Decrypted: GUID list

  1 811032e4-7980-28ed-bc97-4531648d4e97
  2 fbd24083-d819-2e2a-8735-8f159a1db582
  3 42e804b0-48fa-4096-99a5-f19b7299eb01
  4 913a82ec-71e3-84b4-9db0-fb837e61b729
  5 ce4571f5-b574-68c7-a751-71aaf6a0c5b7
  6 2834987c-7f40-1a92-9701-c30755ff1e5a
  7 c83e28b5-6c61-8c0f-b3ea-6f97b70fb5b6
  8 38c2b06d-6161-5cf6-b0da-839126cdad6b
  9 d66e98db-c6d7-0ddd-bdbf-43925a679896
 10 0ab10d02-3139-2f93-8bb9-498772400f7d
 11 1eda5068-bccc-2476-8c7d-5b7544e59555
 12 b7c5898f-f0b3-4a04-a729-5d7371720a89
 13 d48ff46c-0cb7-0dfd-a1b9-4ca269d270c6
 14 839f89f4-b63f-7c02-9c27-9c3a2e1f632b
 15 3868da8a-3dc4-73ac-bcdb-6b4277a32e82
 16 f2c42340-a499-262c-8c11-6634a6e067fa
 17 20ebb739-3c66-79b0-a655-e5955fbea837
 18 a91430fc-c9ee-6e46-84f5-ce638cad2056
 19 57dc35c3-9cbc-60fb-99a7-5f1ab9cde8ec

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2248618502240772766. Exactly this sequence comes out of new Random(114).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 2 of Run 15 (seed 117,733,640): new Random(117733640), Next(8,64) per post. The RNG predicts N = 19; the post has N = 19 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 08:59–12:59).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related