201207090243 w87pi

explained decrypted filler

seed 322

Metadata

Post ID: w87pi
Title: 201207090243 → 2012-07-09 02:43 on A858's clock
Posted (UTC): 2012-07-08 17:41:52
Timezone: UTC+9 · title 02:43 against posted 17:41 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 22
Filler GUID seed: new Random(322).Next(9) ✓ verified
Run: Run 15 (seed 117,733,640) (seed)
Draw: 9 · predicted N = 22 ✓
Machine boot: 2012-07-06 08:59–12:59 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 23 · 8
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

13CC47C40559FFEF CC1B16FAE152985D 1E9FC7AE889C1A54 169437C881E6B5BB 695C8401DABD88FE 2ABB47908B202BEB E3769D704FB950B4 C7D2299FEAEF8104 B5F31B4CAC1A60DE B4D3135E7417B110 DF6DC890BF602557 AB14E71F27A62B01 B9B964F5ED558237 865FA163B0C96C7D 567AA7EDBF23CC77 D638D82FB778A5FC A6A9E8D5FAD945B7 8E4B3E0EA08B90C0 24D87495D0D8EEA8 52A7155F1BFB3218 18769AB92BAEFC18 C254A0A0D09666D3 10630F28E9AB9DE3 C5997F0FCD587CF3 22808ABA5908BD68 7CC8DA58373459B2 90EAED11E78D20FC 2AB9D8DCE2BD152F 04BFC4B8D4B62FE0 51453BA6ED74E590 D0060A330FA01DEF 35FF14655F13DEF1 DFA09430112D6038 07C17C88D023B0C1 08DE5AE7D5E0A31F 5DBF11EDF3B785B8 15C8869B944387B8 5C08B3249A2EACA5 359877A8343DDEEB 37A1848E7C449C5B 2E983373FE073763 36FE3AE3685E6BF3 1148B69AD5B6C15A A739B68EC3A2B5C8 C477B019E41FADFD 804A460C6F4FA552 7D36D1ED54856C7B EC48C39DAD318FA4 64630B1FD0D0C0B7 1F107C87BC6EAEE2 28F592AD70B2D7AA EC98C57DC713B48A B03B0A7D2932B50C 45E4397677D71C42 19B544CED3086608 A262970CE6527F73 8001EDA8C63AE10D 12FF2F676854A96C 6F34FD71BD92D97A 21195741A92083B0 CFA96E09948F1981 16C214D85A099A2C 3C1B400623D0366C 78285CDC3BF2D961 08C8DCF345A05909 6FDA37F37A9B3AF9 3F4406CB210B1415 FF794EABA60D7070 479FA3D1C2AADC34 2E523BB4BFF1E590 1F237610B71C4AEA 80D15A4C0F99195E E8E1705A49E2D982 E85321333EDC3FF4 A1CA1A6A1C66A3BA 933C00AA073AFC84 FF735C2DE8D74B86 5B89DD4426108FEE AA99A4FDFA5D3605 594173B11F5C0C37 1111483C649E74BB 053FD858EEB95206 0BF466A2D5306E5D 4C2D13549EA3DA1A 8D5FE63BFF68160B 6B2B4E58FE251D41 152A0B109E1A6A56 35552E35A62B258D 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 60252f6c-bfca-88d3-ab3c-9ca6cb8d718d
  2 ee8f2bc1-2543-2934-8357-7a6c8e2af919
  3 0765a921-8c92-79bd-865f-70d183e56c57
  4 a48d2496-8dfc-2442-ab23-e45215e07600
  5 7d7a1324-9392-5509-b301-ab27811339dc
  6 5fa42811-d70e-8ef7-a185-6f4f9ee25192
  7 07944209-e333-1079-849d-4be42639f885
  8 786151eb-12fa-8914-a228-fea15f149c22
  9 016dddc1-f9dc-7d62-b28d-756cf7d4e745
 10 de06ab2e-8b62-06bd-a011-ca98d13dc766
 11 cbd5e74f-c31d-4c97-bbe4-d919f6170687
 12 6c2ff9b4-c1a9-7b55-8e84-98194a8d015b
 13 ee2b0f59-767b-8b79-8209-bf4b2887c177
 14 47b69946-8cca-8340-8d3d-dde79af10420
 15 57a79e7e-614b-3806-bf42-013adf2cd533
 16 9305f089-1d2d-1b9c-8484-f6c1f949040d
 17 63e8ed33-2535-1178-8f11-a4a636761bf9
 18 ae1c31fe-f605-5301-ab0e-8fbd55d6eb83
 19 f3e608d1-46f9-3681-a2c4-70681f1dde28
 20 e71e7218-b6e9-867f-a206-8f2933dc860e
 21 8280a3ab-e726-5a16-8d21-011948f0b95f
 22 c5a6f507-ff54-7c64-a9b2-1b66d10cbbcd

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8272581870478831153857. Exactly this sequence comes out of new Random(322).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 9 of Run 15 (seed 117,733,640): new Random(117733640), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 08:59–12:59).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related