201207121130 wg15j

explained decrypted filler

seed 970

Metadata

Post ID: wg15j
Title: 201207121130 → 2012-07-12 11:30 on A858's clock
Posted (UTC): 2012-07-12 15:27:57
Timezone: UTC−4 · title 11:30 against posted 15:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 13
Filler GUID seed: new Random(970).Next(9) ✓ verified
Run: Run 17 (seed 38,757,453) (seed)
Draw: 1 · predicted N = 13 ✓
Machine boot: before 2012-07-11 16:41 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 4
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

5A12AA321B0DA7B9 9795D961DF0966FC 5C512539EE5E03ED 9187AA87CDA30647 85623AD5735BF442 18A023A3366D0AD9 736A790A7D85CBDB 850CED05E1E89A47 98F7CC959816F91E 8F44FD158E32412B 4ACBB5045D0874F3 5DD7E1918BF0404D 13F48AAC6C279EC2 3E5835C322907F32 3B00DB85F176836D 92E7711678AE70EF 9982B5B9067E43BF 51C30A0F39A39B4B 87E7908570731A85 0B7276C72787ADDD 76FA2D0A6738D8C2 BB81DC023DFC1BB3 F2FF7FB4A9A0F30B 45207C2F18742BBA F03E4EABC7BC1AC4 B0F5E580819E8CFD 37DC302F28C1C943 AAE087CD852FFAC1 31F706337FF158C0 A5C70262E3108C34 E2A483DC84EDF890 CA4546E56E86EE28 0802B712765BAF57 965E4C06F6BA96C1 34A3AD68D9497315 0CF711FB2F7D0D64 C88994A8FCBE4AA2 1FCDBB8C25A48E4C CC8F56F4548D4837 2728574241C72402 A89944D9497FEF87 8771F5CE9C928C4B 3E4AB4162580E212 2B67127FD438976D D7A8902F3249353C 89DDFAA34B764786 48070A33892A4D84 4FBE6F2956088D08 802EF03E5920D9A8 631DE76CB507C2CB 9E9A59CDBC5A028D EA8022F67B73AB19 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7ef824cf-12b0-4e47-85b7-6012bbcabd0a
  2 ed0c4bf4-a982-37ea-9c68-159279a08e3c
  3 dc610667-dfbd-70ed-a557-b41468b86bf7
  4 b54f6d9d-b7b8-50af-b3fb-f0c18ce4af2e
  5 6b637581-068d-17ff-912c-1c3fc113161e
  6 8454d00d-bb2b-28fe-b83a-80873bf2728e
  7 17369ff3-ab17-4b7a-a612-97a2ad8955e7
  8 530f5bc7-ad0d-0826-9624-bb0f4702800e
  9 b7acd18a-c101-8fff-ace4-001870f5e8a4
 10 70adee49-2cdf-8d4e-a91f-4441d609516f
 11 c38e7b68-b9d4-8cca-8207-87cca62e9211
 12 c49655c6-e20e-6f0f-9733-000bfa778136
 13 6a9d0522-22dc-43b2-a44f-2d05f0575ff3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4375124088864. Exactly this sequence comes out of new Random(970).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 1 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related