201207211219 wwphy

explained decrypted filler

seed 552

Metadata

Post ID: wwphy
Title: 201207211219 → 2012-07-21 12:19 on A858's clock
Posted (UTC): 2012-07-21 03:16:52
Timezone: UTC+9 · title 12:19 against posted 03:16 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 8
Filler GUID seed: new Random(552).Next(9) ✓ verified
Run: Run 16 (seed 39,036,328) (seed)
Draw: 22 · predicted N = 8 ✓
Machine boot: 2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 4 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

0ABA9D4615C72AA0 A9145CC4151653E6 706A03995B842D3B CEAAF3C0EE689676 3AF2BF8FF609016A 4E1AD72D99D7A1A7 84A862EE67DA05BB 627976DE2ADB0847 6D681FC556BFE0D1 04C7E0DF1A2F9339 8691F2571857D459 4351405E5EBBDE8C DC5639AB7A9AD4A2 9F48B49F28E3497A 2798A35E50237387 C7CCC6DBCA8F043C 909604E7307C010E 2D97FA3EC89D6068 1E260AD1FE97A1B5 8CEA5ACE753295B5 25BF37F5E03B1FEE 3681BF521D3F7318 A67696F2AF59BC0E B459F105AD603D8C E6EC35EBF9202DD7 7E5870D99C709CB0 CDC3AECAE011858F F5532D0D54F7C1BD 0EB3F69271DD3A4C 11850D2439ED27ED AF05458A8B768B82 B6F96D47026087BC 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5f48fe8a-49ca-04e5-a235-a3a2575f8dff
  2 2a24c37f-9f87-7f8f-8461-7e2e6e87f167
  3 36b186c2-a515-58d3-8046-34035975d152
  4 659291f7-db2d-3081-b36f-c35a8756aa5b
  5 60dc3168-717d-32a8-bec5-f8f15c37f8fd
  6 71eed9e3-ccd9-87d1-94b2-33020e87717b
  7 a8f1e3be-b2f6-21f6-ab8c-a3b929bfd242
  8 8064962b-1c79-3c4b-940b-d2670c181ceb

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 07533823. Exactly this sequence comes out of new Random(552).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 22 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related