201207211204 wword

explained decrypted filler

3DES(name+name) ECB, 14 GUIDs, seed 476

Metadata

Post ID: wword
Title: 201207211204 → 2012-07-21 12:04 on A858's clock
Posted (UTC): 2012-07-21 03:01:50
Timezone: UTC+9 · title 12:04 against posted 03:01 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(476).Next(9) ✓ verified
Run: Run 16 (seed 39,036,328) (seed)
Draw: 19 · predicted N = 14 ✓
Machine boot: 2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

99BC9F29BA97B830 0B241F64BDB318D4 F840F8D78C05497F DD373013C6788EB4 46F07DE2D6427036 E074609846E0F153 1816D622AB7B75F7 70E16449F6F12CA4 6F6729752C68F337 A248135C1628769D 22AFFC9981A21F6C 0C6981F70338713D 699645171FAD2BFC A4A56F3235431F4F FB0F1828B5E59679 3C0D62001342B217 646F21FEF42FE09C 3EF56C918E9492FD 1F49560675EE8468 D15366A4C74E527F E867E98553CE1B00 4E82FFEAD7C7F974 8C6AD495D455B204 517DB749DE8F7D37 685F5577AF9B21B8 2D3E0ACBED77590E 9ABCE6323F790FD9 1EBC121CA90797C8 D29051894DE52705 D64D82E8C3B0BB43 366368250744AA25 B49DF1C13ADAD9B9 4D9BB128120E19D5 13FBAED0AC2AD970 0BAE8A793B26CE87 501E9F2E352808E5 827EC8597A248BA9 4E5B77FD77F13CE9 5B69E012F7DFD276 4655008E3C2281D6 1B98C6C71533AAAD C60F6A04F9E0D909 1DEA4018ACDD8DAA 24C0796436ECA84F E1B5ACDBE58B3B8C 909C71FD092C967E 67685DE9277B0082 41BA948807CEC958 5EF9ADFAA5FC333E D2CF02D80FC2BCC1 1DC5F6E05BB1B20C EF34C3BA1055C5D2 F86B55C21623E68A E804F44A395AD92A C6595CA379E8E967 F4077CECB2E8EA21 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 59fefa42-3550-3bf0-b3c4-257377e7939a
  2 b47774db-c8e7-4c40-9bfd-8a9b252a8ae6
  3 a4d6e311-0d95-4149-96a2-412e89d29f6a
  4 779ff82b-5d1f-10f1-af8b-5a37ff16b615
  5 5c21f6ed-6215-14ab-adbf-6d7d359cbe60
  6 c9e31dad-803e-416e-96a1-a10f1325f77b
  7 0b12fe4e-e212-1079-9cbb-39267a4280a6
  8 1dfc95dd-15df-2d73-ac70-293f73bf553e
  9 bbd4bd16-84f9-7c75-918e-7b4182f194f7
 10 6ad6b6d3-396f-763d-a08a-cc87f47e234d
 11 9216bd88-1234-8b76-910a-6eb91c2ad34c
 12 9ae30c5a-b9f5-0309-921c-0644436e292b
 13 30dc1af6-0c05-7921-b058-8ae268cb3d93
 14 c7c0df74-35eb-060a-baf0-24437fb9d129

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 34411412778070. Exactly this sequence comes out of new Random(476).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 19 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related