201207091443 w9amx

explained decrypted filler

seed 76

Metadata

Post ID: w9amx
Title: 201207091443 → 2012-07-09 14:43 on A858's clock
Posted (UTC): 2012-07-09 05:41:54
Timezone: UTC+9 · title 14:43 against posted 05:41 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 14
Filler GUID seed: new Random(76).Next(9) ✓ verified
Run: Run 15 (seed 117,733,640) (seed)
Draw: 12 · predicted N = 14 ✓
Machine boot: 2012-07-06 08:59–12:59 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

DC57EEE136CDC682 281A29DB70F617E4 C34AF8C091295A6E 0C85BAF8E37BD6D6 3DAF6DBD9DC34268 0D32602341E0072F 0FCA259B6F4D70F8 A0E6BE2DF0D29FE0 D196BAC6F6FEDCF1 46502023542C18DA BE825A9A7953114D F84F6B97D2AE2D0E 68D208D6E8DA02D0 01C8C2AB1549C7A9 22EEB7FB7D5DEC08 486BC28D7B2626CE D210A40B9C862662 A4A8D2F36082F685 49B9049266CF6C6E CDB4CCD67F145F24 40BB55AA3F79EBBE 8FE633513E69E938 3E421D6C27F62863 5691DFE03B450B24 E7BBAE9D6EB532CD 33809BBF4A3512EB DD6ABF493747FD77 7CB8F13CC2F60943 76CF8A822C96768C 49296A6ECAD63E2C 747A6B3471249B87 EC62835C337A7E94 6DF5ABB3DAB10EEC DDD7028EED3CA5B9 B2DDDFA762A976CC 637E4DCB2CDB5CB0 E0D86F6A981CF7EF 074AB95E4CBD0498 D5C8924864B0D347 C6BB8F3889D781AA EE0D13911AC74A51 64DF8593831D27BA 33B542C66C244561 60F4D44A22C66F05 DE04C638DF8A270F 815B6226E5820CA6 F78972D30D00124C A9B199602DB24C76 647F03BE77EAE8F4 F1C25949B2D3D930 6FDB638B498C5387 028C6E6EE1AB6051 010F76817A9FF80F 9C729149A787ADE8 D84373AC65B0D6CF D78C8BD9394302ED 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b537dcd7-7042-385c-b1d6-66b36ebcf656
  2 9efe6f38-e24b-1f99-9606-7177430971b0
  3 77288193-064c-8ae5-8049-3836d8385eb2
  4 85495c32-75f6-7551-827a-f0801f92268c
  5 d3e80c74-27e7-4121-803a-a1d872121b76
  6 4b1c21de-4a31-8c53-950c-667cb66cd7ac
  7 896ebdcb-d059-89d7-9753-a3a2015292c9
  8 80decd0d-edad-55f6-b8c8-b0565e245227
  9 58710669-5b10-36a8-867c-bd3139e4e9d5
 10 750f90e7-545b-2fa8-9a86-9b121e1bb75c
 11 81c12acb-21f1-29f4-a40c-3fedb428cb5e
 12 7cb933da-01db-72fa-ae1d-e27c8c2cf567
 13 1062e11b-62db-70e0-be87-b54aabf995f9
 14 c30eb8f9-202f-000c-80f8-ee182a07dec0

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 31874885322770. Exactly this sequence comes out of new Random(76).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 12 of Run 15 (seed 117,733,640): new Random(117733640), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 08:59–12:59).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related