201207170102 wncra

explained decrypted filler

seed 473

Metadata

Post ID: wncra
Title: 201207170102 → 2012-07-17 01:02 on A858's clock
Posted (UTC): 2012-07-16 16:00:52
Timezone: UTC+9 · title 01:02 against posted 16:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 12
Filler GUID seed: new Random(473).Next(9) ✓ verified
Run: Run 16 (seed 39,036,328) (seed)
Draw: 9 · predicted N = 12 ✓
Machine boot: 2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

8ADF3E3FE8C0D97A CFBB74F0584E27B0 661016A957B65C7F 33740219E95E3394 9C18EF01E8BB3F87 5438CE32F28F8BA8 8249B1EF1596E57F 85B84BCBA4E7DCBC 7E11DD5D0043F9A5 A4EFD8D4C585C50F EA2776C4AA020483 CB3632622CD9E9E2 AD2AE065201F2BEC BE2E14BD98002D5C 4E1AD6529F6BCB84 EA61D8080F35109F 8E081B124B8361F0 3363795926739958 BEF76FC21823A0FB 624E14F82BC9B4E0 8747357E774914B4 D12935F552F18641 6197165EB9669E91 F6110CB692BA73F7 DB301E2C29800535 E1627241DE8FC5E1 2976E19DCBD8D9E1 58DC23AB99F89296 002CE8FAB24786BE 91BF57FE8C1FE2C4 943190B0042BB30D 9E8957033DC767FC 77297C8E1D7370E3 66C0BEB0D98517D7 E424565FB73176A4 566E16E22CAD2060 AD22A652AF15478B 4A11D8FC3ECE476B BB4E918E49CAB1D6 6D586396F6B592F8 F8F61A849C8B4CFD 3619BAC2BE120D92 16D4D3650412FF78 600ECBBC8886A255 2392A2FCEB522B05 F4F2AA3C16D55A11 2A676DA78AF8B803 9AA8F4070623CB4F 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4ae1438d-927c-72f4-a5a4-1c0c0251e84d
  2 d396a0d6-e4f1-5d2d-b347-a0e7b09d5be0
  3 0e62efb3-179e-3596-9b64-793d9625f565
  4 d16a94a4-4582-41d7-844f-12aa0471d49f
  5 30434321-28d6-6805-ba75-c670a3d44b20
  6 64b42c2e-5697-8ba1-b7f0-c0957c6ce6d6
  7 9b04faf1-7fcb-719e-8965-3b4090bb30d8
  8 1f75ff5a-5521-61cc-9867-3bee23eab994
  9 57c7bd0e-f02b-4dcd-a480-601f90443837
 10 b0e0f536-fd98-6bda-9f1e-336f5d3db61b
 11 118dd103-42f1-6534-91eb-2c5ed17c963b
 12 cc6f56ea-0ab9-6c42-b993-9cee7b824db3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 753468764666. Exactly this sequence comes out of new Random(473).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 9 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related