201207202330 wwq1f

explained decrypted filler

seed 471

Metadata

Post ID: wwq1f
Title: 201207202330 → 2012-07-20 23:30 on A858's clock
Posted (UTC): 2012-07-21 03:27:55
Timezone: UTC−4 · title 23:30 against posted 03:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 11
Filler GUID seed: new Random(471).Next(9) ✓ verified
Run: Run 17 (seed 38,757,453) (seed)
Draw: 27 · predicted N = 11 ✓
Machine boot: before 2012-07-11 16:41 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 8 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

4F73CEC54EFE6637 E1D567CCEBFBA7E6 A6D2777DA0CDC3BF 1AFCA3CF602F9762 9F7C60831C159B16 4E48DBBA6C7ABDCB 4C5F1EE2C30C5680 6EFF0DFF79F85D2C 5D019B42BD45D743 0D23793FC192F1BB 9CAAC9E2BACBECDF F70AF2F0F7CAF812 71854A5A2880F508 D43233A319C4E0D0 9F14EA677B631426 99917C007ABED891 5B9FDEE7F1D670C7 FED3EAC40E06DDEF B60DD648A0E8EA02 09DBCBF8BDA804AF B69A1BA36482E071 E9B3F4D9402920F1 0A2F960EB47FABCB B1C2DF625F6381F3 1A6154250381BD7A E19D70654E08C42A C35080FD7D82E47A 05D2C9DACD017B5A 3875B3E785E2326D 7EBDA3B79095A50A 32E7798C767B824F E95F67FD19242F19 2B4E3D42F8FDCE26 45C8AD6A2EB8CB97 E1302BCB654E8AB0 F528CFC1AEAECFB6 FE3C689866A1AD9E 23F2EEB8A6C48033 2D6871A29CEADFBF CFFB4CCB6F151A8C E18FF89ED9A118C6 589B5ED3549C3315 2DB085D715275630 92BACCC195FB202B 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 19a3209e-78b1-7fbc-bd1e-05e4ee6e536d
  2 577939af-a7ee-0f8e-bcd6-8c5bca932270
  3 7ffdc385-21a5-8d24-9f04-e356d7cc46bb
  4 aa2cebbd-c450-0f24-a431-cf2ea466e06e
  5 d7ef47d8-fd91-7306-863f-df4c710d7c24
  6 541ad4a2-5322-1d3e-82cb-afddb9294e81
  7 fd7142d7-d28f-8b23-b7d0-37bdc080b4f5
  8 c08ea87d-0614-662e-bdd3-2a634f475b51
  9 5c75147e-05c8-2244-aa29-d691ec0bbb4d
 10 282045ad-43fd-87b9-a46c-2c2794593323
 11 ffde2590-de12-21e4-aae8-75a6374b6196

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 70807186282. Exactly this sequence comes out of new Random(471).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 27 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related