201207202324 wwpq1

explained decrypted filler

seed 424

Metadata

Post ID: wwpq1
Title: 201207202324 → 2012-07-20 23:24 on A858's clock
Posted (UTC): 2012-07-21 03:21:53
Timezone: UTC−4 · title 23:24 against posted 03:21 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 14
Filler GUID seed: new Random(424).Next(9) ✓ verified
Run: Run 17 (seed 38,757,453) (seed)
Draw: 26 · predicted N = 14 ✓
Machine boot: before 2012-07-11 16:41 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

0D4F97D14F273985 C8BC3D84E93B68F6 E0AAD558A204280E 709BC7E576EAC24F 252E19DC81207A2A D75E39177774A053 BE96074155B41710 D148B372165364A4 2654D1C733FC6BC6 0AC6088819761AF7 DA72C38186FF1469 E0CA538998B20DED 71FBF4C7BD29A258 8349592E446258D6 A5BBC8FDE77C591A 0B24BBCC6307EE56 32B99FF9A0670035 BFBFF102687AC1FF 45959C5D629220C2 E59CB56F32F7C914 B0F5956482D21D54 C7CE48BA7D7D23D0 79698B9A181AAA9D 51482125CD453BAB 4E214682DC460F73 7585F8A4230623F0 76F39D01F0C55934 5F8B45D1CBEDFB1A B88ADF5BEA87C598 43877604ABCD1384 BB944A0AEF0991E8 27FE41154ADC181F 1596A9E2C2430D2B CA189DA83968F96D 889CAC854D2F16DB F2B1BA39D6893991 6D6EA0A67E68F586 6A2E39A46F92F415 736ACE647EB20A25 68C2AC30538B8585 9BBFE403CEA52BB8 7D64D3DDD7D63AC4 2BF9D2C4793576E4 D65A193240D2C79C EF9D6990CAFBDC3F 381A31F8C5C0EE32 4386B0AF20ADEC79 76864B25AA0D20A6 58560B30D2DF3ED5 083158AE98D5BE48 1B15625CC25014FC 0367EA7A26199FAC B8375F29802E63B0 86ACB597236D3D26 3179D554E518BE5C 3A02C3277E6EADDC 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a4fc2d45-b76b-29d3-82a0-6550c7c72a53
  2 cb622445-721e-2615-829b-bdb15a173cf8
  3 2f8332db-9ee0-1dbd-862c-fdd979d2afad
  4 56ac9569-d83f-057d-a89a-369864869b12
  5 b04ed8a8-76f0-582c-866c-48ae5d5e5574
  6 935df1a0-cff5-074a-8f92-42445ffeb578
  7 75225f3d-106b-7258-8931-3676c4fff0ca
  8 b7affec0-64a6-121b-9735-fab27ab9b150
  9 6d153ca3-6286-3ec8-8ed4-2afbb02a51ab
 10 d7d1947b-a94d-5164-a4da-4be73d0af2ca
 11 7bbd4d00-51e9-575c-a94e-1456536f4e48
 12 b35ee97e-69e9-41c1-a6ac-d3952a7e0871
 13 f29bb58a-b5da-1477-8448-280a18e077c1
 14 70396f49-8c58-0877-876d-dd584bc5f719

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 22105071355410. Exactly this sequence comes out of new Random(424).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 26 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related