201207080703 w7uva

explained decrypted filler

seed 173

Metadata

Post ID: w7uva
Title: 201207080703 → 2012-07-08 07:03 on A858's clock
Posted (UTC): 2012-07-08 11:01:29
Timezone: UTC−4 · title 07:03 against posted 11:01 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 10
Filler GUID seed: new Random(173).Next(9) ✓ verified
Run: Run 14 (seed 205,976,312) (seed)
Draw: 6 · predicted N = 10 ✓
Machine boot: 2012-07-05 08:28–12:28 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 4 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

23EA514515F37309 AD18EB20BF26F89B EC3B16834AD6C0B5 A9FF59B2815A3E92 20B0D509198EA438 3C834D83F9F2E18D 286065621938D77C 9A98F346B6456AC8 640918510C1636AB 002583AC956832B7 5E890E820AEAE659 3D4B3367137014DB 71E836002681B3FC CE0C58D6F03A6D29 E15082601868EE59 2676638626D8C688 F2E3CDD087FF5C30 027F5CC49A00DCAF 436D664786747E5C 25D37148CD5D4EE8 EBEB01620C856F4C 5E680AD37A29A518 CC347019A1446FC2 5280C9B8C48274A2 43CC40CE7AA84B0D 3E526E97ED95CBC3 D031F6C6C4964170 085A8C1375DC48BB E02D283D3AD29A15 32565FBA090AD261 A280B5CC1892D27C 8F8F2A9410AA085E CED1136C817A52C7 692089641C359392 6858A954C3AC81B6 B3CC44AA37C56991 95D533E53420A9DC AED2F3CF678B6CAC 38541C79FB99E765 1C8A8027E5CB944F 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7391e701-f06b-0f63-91ae-cb8109e93452
  2 9213c36a-6716-56e7-9143-f8b6568a6269
  3 ca45f2ce-8b48-6aae-856b-5d953c0de639
  4 5acd2c0e-e13a-416d-a4d4-f1f8db999c25
  5 c6c502f0-c985-21d5-8bbb-e8ecfe83a453
  6 621ef8be-ef08-6318-81e3-fd75892516eb
  7 34898b27-135f-3ffe-90d6-fe191f95f87a
  8 a3ba605d-9d0d-2e39-bb95-7e4b39afd28b
  9 e7d76181-09c7-35f7-93b2-8b9cabc5357a
 10 6a7c7fc7-ecb4-01c7-bf1f-fe13482a6ab3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0564263230. Exactly this sequence comes out of new Random(173).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 6 of Run 14 (seed 205,976,312): new Random(205976312), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 08:28–12:28).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related