201207151302 wkvcy

explained decrypted filler

seed 477

Metadata

Post ID: wkvcy
Title: 201207151302 → 2012-07-15 13:02 on A858's clock
Posted (UTC): 2012-07-15 04:00:53
Timezone: UTC+9 · title 13:02 against posted 04:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 14
Filler GUID seed: new Random(477).Next(9) ✓ verified
Run: Run 16 (seed 39,036,328) (seed)
Draw: 6 · predicted N = 14 ✓
Machine boot: 2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

D40494A8FBDE985F 668D0B19AAB9058B AEC88B5FBF53CDB3 0E41D26B8331BC02 8ADB4D9F6A99EF1F BE44955469BDA997 90CE4D60027756CB EF06D42436D81DAA E1FBB28956846192 ADB335190FDD6C28 55811800BE8A67D6 F0D6F9ABD791EEAA F669D3A6C2D1634A ECAFF622A0F2EAFE F30EF672407F44B9 B9759BA92E41C7B4 AC0E5B54A5249A53 E327225789C45BA6 EBFA0C52BF2D0EBE 868BD57F81F7C679 204D899C4C70C44F CF152B827D4B002D 1F9C9CC2B46F037E 87650099205DE857 75AEB487C4B98C5A CB976370B59A9456 3C1B2E5429BE5BF3 1E1A96ED65E8E05D 0E976344F95CCCB4 3260F692869C3551 DE84A9433B3E1DC7 EBBB38B3856C8544 48035A2F3455AF3B 21F3BA437D55FCD7 3FC7D361D184F2B2 FB3E317B79A9CDD9 05F737FC5A58B7DA 7C4F010328652EA5 3E5BD0EA374E436C F57FF8486CFE385D 44B8ABA6630AC4C5 89A299B9D578D29B FEADCB21F0C0E4A9 88DAF33E8C61C238 81ED8AAD21320D48 ACB022BF640CE911 760AC7E62C5EE84E A564DF83F1F37B72 311599DD9FD651BF B08B34FA820C35C5 67924F656993E5F2 620010982D452FCB F85E3DD2412BD00B FA23D5E87067ADDD DDC8EB859A9A11FD 6223C5FA094460AA 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6b74eace-cef6-8df1-bd1c-7759e672729e
  2 db4647c5-f4d9-7bf8-86a8-6d1ffd0e3476
  3 40d0d524-8204-1954-8527-b9275a2f94cc
  4 207858d6-a738-37db-b259-0c84bab599f4
  5 64bf5f89-7b0f-5471-8b46-163347d8f41f
  6 bab22f28-196b-35c7-8f70-018431496be8
  7 44bacf52-869f-56fb-8299-bbd3707c0241
  8 f84df981-0860-6576-9676-e9b68aa02dc1
  9 4633df14-71d4-8ee6-8ff9-b2bd8ef943d0
 10 32f6a887-f1b0-10e9-974d-9787e9693ad6
 11 4753ac1b-946e-6d89-9573-fd0de5e30f2d
 12 7845df58-e243-7132-bb01-c0c44369b431
 13 22d3d9e1-85ec-42f1-a8cc-13320bef1bc0
 14 24b7e686-ddd6-50a9-add7-0581f74831cf

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 87135356816745. Exactly this sequence comes out of new Random(477).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 6 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related