201207162330 wokvi

explained decrypted filler

seed 892

Metadata

Post ID: wokvi
Title: 201207162330 → 2012-07-16 23:30 on A858's clock
Posted (UTC): 2012-07-17 03:28:05
Timezone: UTC−4 · title 23:30 against posted 03:28 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 13
Filler GUID seed: new Random(892).Next(9) ✓ verified
Run: Run 17 (seed 38,757,453) (seed)
Draw: 10 · predicted N = 13 ✓
Machine boot: before 2012-07-11 16:41 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

1658C86CC0B77FC4 4C68BAE6DA72291E 1C43A09FF9E4C806 3A46B5535892DFE4 1F797D926E2767A5 EE2A0D584A6F9947 5FB299AD6A5366DD EF3A082C48C8D420 DEEC44BB3B7CEEC6 8FB8EC99D69069EF D6EFDFB540A326D7 6BA69785A7A09B9D 31D8DC1076F7E304 300B031F72826C3C 7C8D52004D03300F 44AD7CC8456BDB5E 314150C043B9BC2A 3EA8578394CEC4D2 20DBF86ACB353CD1 B26F018058E5EDEE 0698543593E502BE 365C50AA4C7670DA CD95243529792CD3 DA952E8AEBEEF4F0 9B3F47EE045CF740 20F0DD0F044709D3 E30E2BADFF1D5A48 6736C12C0C88F0B3 5566814CB4D900A7 7969AECCE2C8C1A9 866882FF3A8B30EF FB18D9DA5CECCFC2 5D186E4E37660055 B8710F3826B2019C 4874FE37EAB342F8 92DE2C1E7507BECA 00C376827995B8D1 E8795B40AD3C21FE 1854EA7CDA17C3E3 041DF37390B7F801 EAC7678BA6BA3371 18F913AAE3210D0F C6B453119D61A3CF 0DEE5D24C27AF250 42A3A73B7B44EADB E2B10DF55B69A47F 89808A88CE245548 021FFD70C42DDA2C 8F0131816F4005C3 FA3C30BFD1796B0E 6A81C0AA8F393596 7F42328D17BF9880 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cd748d9b-cb33-69fb-b227-54ea9920460a
  2 654a0496-5b55-4950-a7f5-4100b4665335
  3 214b96ef-fff0-2121-87d1-5257a7ee3c3f
  4 a5c235c5-5943-8a49-8fb8-75b56b41b43d
  5 9055fcd0-a4e1-87a5-b3fb-14ac4df368d5
  6 a9265da0-22d1-0512-8ff8-94b315efd0d2
  7 32a4c8a4-7de8-532c-b942-106b9de772bf
  8 eccc5eea-cde2-850b-8a84-af87d6f60317
  9 7b4e30ee-7277-28fd-83e0-169ae78cb90c
 10 80420595-f956-18d8-8933-db94e38f5686
 11 8ef3e78a-8f0b-4cf9-81e5-b15d368bf52f
 12 5b20a170-3af6-7d9c-bc7b-c262424085ec
 13 7ba66a76-28c8-7052-9e78-72b66c1327e1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6428805821477. Exactly this sequence comes out of new Random(892).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related