201207211239 wwqht

explained decrypted filler

seed 215

Metadata

Post ID: wwqht
Title: 201207211239 → 2012-07-21 12:39 on A858's clock
Posted (UTC): 2012-07-21 03:36:55
Timezone: UTC+9 · title 12:39 against posted 03:36 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 11
Filler GUID seed: new Random(215).Next(9) ✓ verified
Run: Run 16 (seed 39,036,328) (seed)
Draw: 26 · predicted N = 11 ✓
Machine boot: 2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

F43D83AE0D5F0F29 0BC2B98C64AA6924 866E695AB921A77D 86B508D6152B87AD F939C08F95262573 B5E95566D182164E CED2E9E4CCF7347A 4066753655F910CC E713E3BA6CCA0571 2C60EFF35475C231 2F44AC7AD6BD5203 A74C0EACE5CF11E5 F980EC9A50DCBF3B 16C444E23BC0D5EB 446387C1B4885F66 7F6DA5404F6259BA 73905C4134A6EF5B F749E0A480D8A97A 4913CE465ED735BA F8E7A01CA5A754ED 7DF9AC608DA5D8D2 85DDA31F9387EA4F FA1ADC5039F4ADD4 096887FBFFB840E8 0A645425E0C763D3 47BA684E0D392B98 0DC654B8EA0A5896 61E28F621AC700D6 B5DF97A85E276266 29138024244723F6 D6BB825C80C7BCB3 33C32727BF441EE3 5EABFC3850D79EF8 A8D24AC47ECC0ACD 284BA081EDDED3E2 368C85E652684A12 FA874A8D71B9220B 5CDCDC5055E41136 260F16F0EA3FFBCE FBFF4E7B5AED3E7B E671BEE0894C3B28 9134D32BDE34DED4 ACC78CE53F4C9B22 A2776F3C28CB1883 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e9755608-ce50-0c17-882d-bc3949fb16cf
  2 fd99dc86-7266-8816-af77-51a07b71ef48
  3 36f80dee-ffe0-0131-a954-c38320e562f3
  4 705442f3-89ed-43a1-9303-3bbabdf70ffc
  5 1ecc0f7e-3e18-2e8c-ae8f-19fde6841584
  6 d60ce0b9-0b87-4e64-adc5-701d6e4051d0
  7 287351f7-a95b-21f5-a038-4405bd730f37
  8 e5b95af7-4be6-218f-ab7a-a4224435d9c9
  9 a96311d8-af78-5142-b14a-13cef8fd68ae
 10 7d00658a-9a7d-4d30-a5cf-2ab49aa1130e
 11 c2afe671-d1fc-62f0-9fd9-6be154480f5c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 08042422546. Exactly this sequence comes out of new Random(215).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 26 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related