201207152330 wmiir

explained decrypted filler

seed 486

Metadata

Post ID: wmiir
Title: 201207152330 → 2012-07-15 23:30 on A858's clock
Posted (UTC): 2012-07-16 03:28:03
Timezone: UTC−4 · title 23:30 against posted 03:28 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 18
Filler GUID seed: new Random(486).Next(9) ✓ verified
Run: Run 17 (seed 38,757,453) (seed)
Draw: 8 · predicted N = 18 ✓
Machine boot: before 2012-07-11 16:41 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

7504817E187DF973 4C95030E398DB9C0 02B23212660DA3D0 678DF343CEE17015 6714DEC5A311DCA2 76A7CD166B0E0605 E20CEC24215BA2A5 F01258049FE56205 D1DFA5AF749188EC 51C17B5EED13E1F1 7E1CFF171E5E10D9 72CD99092F8CA5F7 40EDC70C706C9DD6 13A4379A751C79E9 9C0CD1E42E8F73E9 EC0B607A1B8601CC E36BF5352B2A0C1A 9EE3FDECF340FF53 AFD3F489F92D06BD 35D970EF0970355D 02F43A05BA6B511A 6C23BCC51C3F5F75 1C20B26010222ABA D679FBA6832AA904 1538B16229A8EEAF 89C58F080FE54C03 7D2392182E2465A8 A24203CB0CBA7CD6 2ACC9B2EE714239B 82850B28E214D7FF 4508DC25CC334843 F69C6BC7DE8FC3F7 0A6A291931165670 9AD20B96BFA750A7 62B88E83BE1AFDB7 0BDEBFF9B2360520 2840046DB1725002 517F4E4724ECFCEE F7947FE010FB221C C187C0318530CF03 5D95686D9C1DD190 7AC515F44FBD0F6E 1B03E431177E2A33 1327B0E79B2E9511 55AC686E91B8F4F7 50AFBDCEA222F302 FBDB69A4E4CF7D75 2F3432674CA7909C 2747AF9D5D4FFF8D F92A53E2183819CC 89CB86A531E5864C 42FBD472F58DC755 01B19CA80483E89F C54006E958683419 B9057825278C99FE 763A986CBC8E83BF 50C498A3C5354592 A7DD95C6EDCA0536 BD5AF8CEF4489620 3AB47EFC882F8758 89812298923ACE2E 8C19ABCAFE87380D EECA69101D61AE88 B88B6E142EA42576 50C55B6A5C9EB5B6 DCC8B211372712B3 CD94320CC9417585 E85CACDD029C1B3F 08E2D3B7CAC950A8 1FCE51D3A2929D16 21D9CCCBDC6A6164 7A47FF17A201631A 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9c9a24c7-8ca1-5d41-abde-9bd80533bb22
  2 74ef41f6-aaf3-348c-ae76-6df58cb89b04
  3 20cee6b4-5abd-423b-9945-ec8857eeaf57
  4 64896fea-9b40-2355-9341-97b4963c1bf8
  5 2ab1d042-3a21-5be9-ad7f-a504afd4519a
  6 04d934d3-ef9a-271b-b415-614b2b737b56
  7 d9ef6214-04dd-5b0c-8ecf-270075a3c6d0
  8 5c685436-0ab7-2bcc-953c-5b08200197fe
  9 c8d636f2-b197-0524-8cc0-908017babcf9
 10 1469c8e1-3473-4755-9676-1a04ea47a5b1
 11 f16e28a4-4526-3d49-b632-07137d37a0a3
 12 a2e10cff-fc51-8611-ad11-0d56b0e8379d
 13 39e6c12e-7e6d-64b8-b101-e15d92cad636
 14 d86f00be-8f28-2565-a602-a11bd8c70f14
 15 072983ce-d853-140e-bd7c-7ea8062b6f96
 16 4f4bf05e-bb16-4d29-adf0-a23619d9c7f3
 17 a467074c-6941-1421-8bb1-44ca37213348
 18 ddeb2e26-3b27-2744-8bc4-5056ff8cb31f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 534252520438621412. Exactly this sequence comes out of new Random(486).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 8 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related