201207091344 wa38c

explained decrypted filler

seed 766

Metadata

Post ID: wa38c
Title: 201207091344 → 2012-07-09 13:44 on A858's clock
Posted (UTC): 2012-07-09 17:42:06
Timezone: UTC−4 · title 13:44 against posted 17:42 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 8
Filler GUID seed: new Random(766).Next(9) ✓ verified
Run: Run 14 (seed 205,976,312) (seed)
Draw: 15 · predicted N = 8 ✓
Machine boot: 2012-07-05 08:28–12:28 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

5CC79DFAA771BE96 9F3D97B86185395A 7209488C143322DD 1CE6EC3CEF09045D 1E6F4453B82B2C3C 85CF7E7D9838EF7D 2248DC9CED4E9C50 A5FDE10C54F53140 BFEB257B5A4F6214 2283309A652D9534 51C626AB9139A886 4F1CFD36E496FFD9 74DC19E245EB9907 225664A520468012 12FAAD678392B338 130A7B21F07031FF 71C54A556D1718CF FA7D0156C4A5BAAD 1EAEA6FD004F0890 06050AEF99C26B14 74B70BA11851628E 5C42255E00517792 2EB7BE00FF54F6F6 7C39854CEA7B55FB 32E7507E7BB04EE1 7B8439ACB6122487 BFA7DF3B667DF454 14EE6684B5DA4B2A 8A0176A0F22729C1 76DCB0CF10E938C8 0565B69021CAE5A7 EE4DABE0C23F3061 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d9a903d4-fae0-8ad5-9782-f07b5d17b865
  2 54c5c523-f50d-5827-888a-2f93ffe01d08
  3 c1378036-9fa1-1f60-ae0d-e267b906cf15
  4 069d3979-6c40-0e3b-93c5-caeb2c7a6a57
  5 fe4ed567-7ec4-0396-8c1e-b7e1927443ed
  6 fa423918-eba3-853d-97c8-7df4814e856b
  7 5e4403b9-c2c4-1057-b45e-7a007efa1e4e
  8 0d1bdc88-b865-6449-96ab-ed5b1525bf89

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 85100816. Exactly this sequence comes out of new Random(766).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 15 of Run 14 (seed 205,976,312): new Random(205976312), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 08:28–12:28).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related