201207151130 wlfwj

explained decrypted filler

seed 517

Metadata

Post ID: wlfwj
Title: 201207151130 → 2012-07-15 11:30 on A858's clock
Posted (UTC): 2012-07-15 15:28:03
Timezone: UTC−4 · title 11:30 against posted 15:28 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 13
Filler GUID seed: new Random(517).Next(9) ✓ verified
Run: Run 17 (seed 38,757,453) (seed)
Draw: 7 · predicted N = 13 ✓
Machine boot: before 2012-07-11 16:41 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

02C1C2DECECC2774 08BCA4EE3C586CD5 C88F090455D84751 5A57EF1D3B592AA0 35938E45B9EA504A 8B62BECCBB97443C 26B9BCBD0841EAB8 6380C18CFB1F908B CE55391368BADA59 0B0C9F55D15A32A5 7820541F28D149DF 8FEE3E7823E94E5D 23B34C6864D03EE9 0750A528172D4341 3250F3D4B886AF0B 4FB5F8AEC4CA2A59 7F9CC9740035C2C1 16F250A8D195573E CB85839A619190DA 2104DE97710EF48F FBA0FB63444749D5 0A78A76319A0B54C 1F5DFB4589FCC433 411FA8D6AB5158B7 E75E346678774BFD C9C70B96F7F28224 7D92F79DE98A5B8D F908BC2848DF93F9 0DAD8BDF2296402E EDB2F192912473B9 BBBF1ED3F3148123 6185263E9A45EDCD 9BEBA0B22176924B F1B60819A166BD2F DE61C888444F12F6 5DF7ED62711D012F 380564035459EC07 3D5B1558E1BBD878 0D4BB8B452BE9B78 21DF771DBA431CD3 F44DCE9401F3592D 6C9FCED5DC1D0F01 67E5565D57FCBC2A 8311BEB3D28BC415 E1677DB98AE5599B B93E9AAC49296DD5 17133B13BF8EA413 F4E73919F0572392 57A64ADB5AF216AD F285E32CC41ABFCD 0F80F6C907AA9777 1B36573363DA8ADD 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d118f5cf-811c-7e69-bcc7-a3a738c7fe77
  2 fcc1fa09-b2f9-4ab7-9211-4370d30fac31
  3 5b127589-02ae-1788-9fda-57f7a2371a59
  4 9b4f2c1f-934e-8def-b33a-bdff96cc0cc6
  5 25d77294-f371-5c43-8ae9-845ea08b2cf2
  6 0b5730d5-ff3d-350e-935e-bf7c29526c8b
  7 bec4ea5d-1b53-4738-89f8-762d166a1abd
  8 c5e3db27-fdac-708a-80b6-357550eed19c
  9 8871e8c6-ef83-84fb-af64-8a510ae2c83b
 10 070aec72-b4f0-8bcf-a147-8076e7456a4c
 11 e56e4457-1840-1aa3-aa26-39c38f85c2e2
 12 5d7d55df-9e43-00aa-a647-c55c9463fac8
 13 a84a5722-9376-0d67-89c7-22aec0550986

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7418534788100. Exactly this sequence comes out of new Random(517).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 7 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related