201207211159 wwohz

explained decrypted filler

3DES(name+name) ECB, 16 GUIDs, seed 496

Metadata

Post ID: wwohz
Title: 201207211159 → 2012-07-21 11:59 on A858's clock
Posted (UTC): 2012-07-21 02:56:49
Timezone: UTC+9 · title 11:59 against posted 02:56 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 16
Filler GUID seed: new Random(496).Next(9) ✓ verified
Run: Run 16 (seed 39,036,328) (seed)
Draw: 18 · predicted N = 16 ✓
Machine boot: 2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

48516A85AD39A6EB 0103C45A9522CE2F 1B20F5D3F271A924 57A3CBBD0923C352 E5A51E80EB39051E 770826E23D85FA4E 311CEE3D18E3F084 87F45EF8EE2E3C01 6452F4CC319FB8E9 8699B094B6E299F0 1A70A0E59CB60F39 0D409378C112C1C9 0151BA26B4513D47 4B5EFCB7099ED05B 38F71E5285E9C084 B9617B43D4D5C904 E2DFAB4328196F26 46694A567A6F032B 2E65F20498BB944D 0FB06869BE7A095A 293AAF9EAB48EF36 67F62F637AEFF784 5EA28E113A5CAF04 7B5ECB5DB97568A0 6DF50862B0C47AD8 9F376848E6EB6DDE 2FD6F2B4BB38B00F DF356C318DCB3367 BD4F13FCA3C06CF9 C71388BC2302865F C3FD220582F026FD CDF0A98E3C6359BA 6EEA7AD6F839D63C 8392EC1589579C10 1FC543073B6A1475 414DD937AD0DAF2A 2831C895BD54C8B0 BD488008D48F64C5 5D38ECB2CF2F0B0E BA42670CA06707C9 E9D1BFF78CC9AA1F 6CD9762B428A8547 9EBD31959AB958A3 29B6086C695A25FA 819C2ED5D6DD1E06 46F72E2178EDEE0A 15656837A18D9202 7E68D6DA556F2D75 460DE85FDE3E5DD5 D4F6182022F772D1 7C9FF9566CEE3D64 54845B478FBF4F15 C6934E9FCB5F24E5 CE614FC8752C55CA 70455A75C4191892 9091DC2CCC5C0719 944780EDFB5BE019 DA1A49F6E559209F B11EA1BEA1936430 F3737E982F6FBE4C F37FD40CB2A21A4A 5B0733E10022C82F D0AD2E1116F58847 9209D20244745E54 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 709cd904-eeb0-7f63-838a-5d03f4e52751
  2 a40664d2-0b8e-32f9-af5f-78f90b0543a9
  3 a45466a4-0ec1-4a29-af49-86ca4fcc1d05
  4 4d4079ae-883c-3e45-8445-6d2c552c71bb
  5 8e5f5e0a-d0f7-1c28-82c7-12eedf98fb88
  6 edcf252a-e6cb-087e-b29d-7666840a1bac
  7 4518bf48-00a9-1563-b158-93499b9e9dfb
  8 f54da417-3df1-2b42-871b-1ce92a11875f
  9 9a8bf493-9d30-3995-b954-c0a157f74b38
 10 5fc57bf9-34c1-11bc-9a0b-e233244e64b4
 11 23a0d298-d4c3-6f27-9d76-eb15464ca39e
 12 4d0193e4-9d17-6487-9563-3a922709c843
 13 192a1e3c-b2a4-5255-8cc9-d638b517037f
 14 a67d663f-b127-4b46-b49a-145cf2f72836
 15 3054ea17-8513-1175-ad84-4bf2436dd8f4
 16 f8b00de0-e6bc-7f63-abed-6243338af72d

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7343101231665417. Exactly this sequence comes out of new Random(496).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 18 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related