201207131302 whd0f

explained decrypted filler

seed 404

Metadata

Post ID: whd0f
Title: 201207131302 → 2012-07-13 13:02 on A858's clock
Posted (UTC): 2012-07-13 04:00:55
Timezone: UTC+9 · title 13:02 against posted 04:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 21
Filler GUID seed: new Random(404).Next(9) ✓ verified
Run: Run 16 (seed 39,036,328) (seed)
Draw: 2 · predicted N = 21 ✓
Machine boot: 2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

A4E47334EAD5FAFB BBFB0E08DB45CC07 D41461BA64953194 D1B933CDCE74400C 8B6DD2B343BA5153 E1D09A71E6CD84F1 C0A592A9955FDF26 920EF2D32FCFF0A9 A28EFDEB63789FEC 4B00BCC69F218D63 75BEDA23FCD81A9A 1D3F7DC282F3C36F 368306DF7CCEF9A2 D809488F241DE6C2 A994388A9F7ACF67 D91983BF8684B924 9154696B97C5BB50 053674ECDB777D85 F978F5D3EB59B4A1 85FE1749997D7B66 3E34F1B9065AFAC2 137ED9CCCF05B64A 788308AE543EEF36 B966950C2056CA66 D59BCE34B24C2755 F2CA5BC5DFD8C608 74C86BA03872178E E0C8FBACA1F5C9B3 45EC44E3028BDE94 99EC99B8CD01F922 26058003CA1E6F4B 2E384C000601506A 88582702C4DCE098 64D1E8E75F8140C1 AD0681E7B8E46819 DFB46600AF89B4E8 A9F60EDBBC0ABCB5 CC3F2EA4220DE8AD DEB621D15CCD9807 256713A8659BDD4C 41182395A08A225D D61A070802CDE177 6C3AB904DBEA6A1A DC248F186CD8687F 29227BD660437C93 19FF6278EE81CA02 E32F44BB06899715 DC48CA5CF58EA522 C40293B0C21C86D7 8AB8FC34E70DB0E9 43E7FBBC8A3B52BB A6643570DB6EDCD1 94450A45CD2947CF 10F62CE8DA116C04 AA315C66F695AA6E 90F327BB95B16B5E 4838EFAD76E6E72B 57FA9749210CB285 A630A53C80F60DFC C41F16F5670D6525 F8789578A4E2C9E5 80EE29A3D8DD93D2 02BAC4C3C2831686 12D9189B73ADCD45 A6009040B5146C32 10AF14600B7999C2 245F3A5CE7371599 89A9471CC7FFF5E7 767C27AFB9E27B24 3780B332B856202A 340B064600A99BC8 B52BFE06907A9BDC 47CD3DB114AD6651 365D83CBD5F3001D D88C9512EFDA4489 7A5999951DD301EC 94A6503ED3D2C1B6 430BFDDC0838EADE 516DDF37A089C351 F4CEBC1E9F778177 6134D31ABC034C1C E9A8D654B5D9109B 3B393BD6820FFAA1 3C7AD3E3B20841F3 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6f805c88-b677-75ce-ad61-6e0a9fd28d11
  2 793f051c-8335-3412-9952-72b6ad8768e0
  3 4bb507a3-bebf-191b-8c59-ae823a7a9527
  4 ec94c0f7-d2ac-75a9-a02e-2dbc5c211ea8
  5 3659f460-3dd4-5376-b3aa-8c817471867e
  6 e9ab4895-4bd7-584c-8393-26b6d5b5e34b
  7 3b19d2f0-0fec-8e8c-8875-41e07581216b
  8 d2fb9e17-290a-136c-9d17-a1ba4bff2406
  9 958c8a78-979d-8ae0-b993-70aaf4041df6
 10 d2d1fe3e-6ac0-2a5b-9304-0db40a5049da
 11 5d3d60d4-9a74-851d-9688-1180defa185a
 12 dd5be48c-7ab2-7362-a09c-9c585d2e3dd2
 13 39d55dbb-07ec-3423-9660-11d972309523
 14 647f832d-f175-5aa1-9559-33135611a027
 15 2c5d0afd-e8d1-6f78-b052-dd4adb23f690
 16 d8b6f957-4ed9-35dd-adf4-700e3c97aed9
 17 76b9194b-86d4-6e00-832a-dc03dac220e9
 18 054f7d5b-dadb-447f-924d-f10d78fe659e
 19 71047ec5-667c-5b07-9e71-205ceed55b42
 20 6917dbdf-2837-66ba-9965-61e754306641
 21 5820e75b-9978-497b-9584-257b509d8a2f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 731755818287356364564. Exactly this sequence comes out of new Random(404).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 2 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related