201207211154 wwo93

explained decrypted filler

seed 834

Metadata

Post ID: wwo93
Title: 201207211154 → 2012-07-21 11:54 on A858's clock
Posted (UTC): 2012-07-21 02:51:48
Timezone: UTC+9 · title 11:54 against posted 02:51 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 12
Filler GUID seed: new Random(834).Next(9) ✓ verified
Run: Run 16 (seed 39,036,328) (seed)
Draw: 17 · predicted N = 12 ✓
Machine boot: 2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

6B35F59C44F8163B 3940436AD0019AC0 9DB0459A9A6363F4 40934C5B9655783D D39ACE2DB8887886 C172F75A0489A101 EC93C7F6994B2F51 61A0D7BDB4791121 E18EEC8AB8EE72C4 12D0FA58206567B6 1BDC44C38B0F4329 DCE5041299FB9506 CE93570572F51425 9B054380A69A7AFE 4A0680273C477ACE BB8F7B185C13DCBB D4C9BF3BECF05411 D5C93A94520DF91E 3FE088ECCF2A2C10 BB7EA493C39899BA 59CD115DA1E51222 8D090B4567EACAB0 70FAC38E20FD9233 A11D5F04B220B3B5 CF1E1CA788588553 E9D130D2D26A2AC0 8C17E3B6C86281BC 505E999EE43C36C7 CF7B82772C9EBA84 E2DEBDD4C5EF98F2 0B3FBEA6B8417BC7 8CA093280135D9B6 8631B4368A033F80 73618570967F9D49 EA82927049FD971A FC62EC73445036D9 3F22BDC29E2BFE87 C9584746B6E6949C B559200EF04476C0 CB9CC78A858D5B8C 59D52DC07A6CD53E F744830A26F1F3A2 7F544D0E68DCF63C C0544A4F220BE2B7 3D1A1CF9B507DE3B 809712F760EA8CDE F389A7D5B8FA812A 84873FE78D0FABED 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2dcaea39-f694-3359-9aa1-e1b54ecda49e
  2 437479e3-682f-45c0-b37a-008e289b5832
  3 28cc15d8-190a-6e0a-8e2d-98a24fd6fb28
  4 09481dd3-d7f1-579f-95c4-f5ab89cf4bc0
  5 192a93c6-8d14-6960-97e0-9138e66f020e
  6 0a96c069-8c09-3d07-94f9-90586e716047
  7 307df126-cde0-5110-94e8-312216d1227f
  8 6a1ccd03-89a0-73cd-a85a-40b141768dc9
  9 4ea37c88-6ad6-18be-a190-d40e2b91d674
 10 cf6e3f60-8d13-74ca-af13-6763f805a7fc
 11 5ecf318a-f015-6116-99e0-52bdb370bc9b
 12 895e700f-5a0c-51ee-8efe-066f9e8ae7fd

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 346563571765. Exactly this sequence comes out of new Random(834).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 17 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related