201207130102 wg38c

explained decrypted filler

seed 201

Metadata

Post ID: wg38c
Title: 201207130102 → 2012-07-13 01:02 on A858's clock
Posted (UTC): 2012-07-12 16:00:56
Timezone: UTC+9 · title 01:02 against posted 16:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 20
Filler GUID seed: new Random(201).Next(9) ✓ verified
Run: Run 16 (seed 39,036,328) (seed)
Draw: 1 · predicted N = 20 ✓
Machine boot: 2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

006D16619C094BBF 99A4A2123BB8DE1E 946F4D5B2E6BBDBC C5EE35D65E948E94 FED3341F54D43166 AF47F0FD979ED188 6CD47516605CFA51 412CA9239A36E0EE 49C39E8B2F72F2B2 1128480F6B0B6C73 355556457AE9F043 703BB92DB8F7AE4B F083860B6474B9E9 C1259C05388CADC0 9BF49676E1CB4075 9CF85DD0B76D3602 38D334060EEC227A 0FCACF1EA6E9F249 18D8A5DFB0A67512 0CAEB4DC1E7AB5E5 CC69514C087631F5 66B65D4AEB89E00E BAF100BCE68E5B3C 83FD2B77C6147DFE F5B3B275FCCE4A62 F968B45D78C53971 62A053C92DE83B9A 561FB5924E5749C4 ACD5AF02B9B6A74A F123C4E1796FCB39 1D75A4F0DE11265F C5387526CFB56FB1 B2C8018E4BF3DB1F 4A836512CFC3692D DD9B3C3F27144C1F 982C34B3F990D66A EA3D1D89239D7FDD 2D2E728E79EA342C C958F534149FE651 D2C438E703B26639 A97FC35B8EB2A708 2A12A29FFB3D4FC7 FE091EF909276BF8 0C3002AAE7EC7B47 2005C51DCA031D87 28199821DD6404E2 122C42D3F6B01848 8C3AFDDD4F93A1F2 9BCE5E0E0DD89882 7D9E1495F9166557 108AFDEA9523A858 44A967FCF73D79B1 D4CAF317897B46BC 8FD3F5F0CEB8B448 E443C49834E3E557 E5C5FE9881E77414 A0A0EBD53B237780 AD350A1B89F86AC1 520DF66D7E478AEF 5B19ADEA33A6933F BD468665EB25395A B8D51B3AAD2F45B5 F9DCCEC8C339B16D D95A01DC3C2D7FC9 A9EB019750D71C75 7041343C7B713838 77012146D1023144 4643AA45792C6BC4 AD885612325D85AB 170EF1717289B819 BA6F549B4B5D5510 5A09FC2D60331343 03BCD156E582107D E4AA64C705138F69 4C9B18BA0A2BB6C3 F04FA8B630F72749 B15C572FFAAB5603 3DAFF7DB9D3F85F6 10CA2EE1D9233E26 5616C21CC48E0D94 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c1cbf018-a33f-6cc2-9dec-09e7384020ed
  2 a7e881e8-d5de-7375-a950-37dce927e577
  3 83b8594a-7284-2c5e-9c98-e38cb2c7956f
  4 c7340cdc-aa0c-438f-802c-fb113176d41e
  5 7eef91b4-6175-8f2a-bda4-774d08a889b8
  6 e23360c6-780d-1a9b-adf4-66933057af61
  7 eb93f946-5e5f-84d8-a096-3ac522000f92
  8 64e6524b-ab2d-26f8-bfd1-9e80a8730252
  9 41baa96e-062a-7f17-9686-bdb4e0d880c5
 10 666043b8-2be6-339f-a3e1-a844c138a0cc
 11 f83a6926-b0fa-37ce-96dd-f16426b0ad87
 12 e9b4218b-ed57-3b6a-89fa-1aeaaefa1137
 13 60f4a688-b5ea-788d-a800-5e521fe292d8
 14 ec171269-18a5-0ae6-bc55-db3607293d01
 15 f52ed422-6072-6b7a-8b8f-32ab761205a2
 16 c1cd159a-9e6d-569c-b25d-3f43cd9aaa6c
 17 73f14f24-11ea-3ce7-9d28-831357dd4864
 18 9f4a0fea-60ed-5f5b-bfa9-96a329d38b83
 19 0cd45d88-b050-1182-8f22-0e25329e9c1e
 20 58fa7905-fbb6-13d0-8742-6f5311b5c5c1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 67248182733370653511. Exactly this sequence comes out of new Random(201).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 1 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related