201207090643 w8kbq

explained decrypted filler

seed 49

Metadata

Post ID: w8kbq
Title: 201207090643 → 2012-07-09 06:43 on A858's clock
Posted (UTC): 2012-07-08 21:41:52
Timezone: UTC+9 · title 06:43 against posted 21:41 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 10
Filler GUID seed: new Random(49).Next(9) ✓ verified
Run: Run 15 (seed 117,733,640) (seed)
Draw: 10 · predicted N = 10 ✓
Machine boot: 2012-07-06 08:59–12:59 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

BB7DFBCF2CCC1E73 0B23F77973748DE3 626A368726EBA569 2B6254B58B773625 2CFE8051237F5C25 BBACE7473B68397B CDB77E0C48D69828 69CECC43ED5E461D 3DC1DE64AC17386F B20D01C314A41221 10C2F8A5F13635FF F0D087B913FB9C3C 11F6351B9DC836D0 4CF979DC90E5B0EC A103244CCD9C0E3B 088F35A04A7E0D12 6D0AD4F686DCCD93 90AC9A1BB221342F 9FCE6ADFE9676033 6AA7A5D0CA646952 54012BCB7DEC8CC8 F6337D151CCE4F2F 20842D4CDE6A16DC 3104CF73103FDB9C 769B68CC1CEAE3F0 335169E3B2BB80BD 827C090CD7E94222 3D14C09D3E907885 B0AFB9F12874D139 6A3D26F754D0AE9F 30D88AE0CCEADA5C B76EAC6CE384DAF8 CF31DDB164B0396D C404DE8504720154 AEF258EF72F892A0 B833DB461EC8CB2F 9B2591B5BF80E53C 4A9BA0684249D380 9598A58690F2A88A 2AD3FB30BAB783E1 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6441a593-a578-2fb6-93dc-2b2e6d8f8441
  2 b398ac08-1bb2-132f-ac32-a21cb4b455c3
  3 78a17176-3def-0065-827f-fd99b5bbee7d
  4 7bf706ac-787d-0770-b225-2d55d454fca1
  5 4e93105f-f5eb-205a-ac30-12828948b06b
  6 01ddded0-04b0-34c8-b6cf-52735519131b
  7 ea6d8b68-c5c4-7201-8bb7-c3c0131ad12f
  8 ffefb647-412e-051c-8215-7e648db95065
  9 7f2b3fc6-68f0-0597-b884-90d40efda97b
 10 2ee39958-1473-3034-a787-16eb03272a0c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2100237003. Exactly this sequence comes out of new Random(49).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 15 (seed 117,733,640): new Random(117733640), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 08:59–12:59).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related