201207202348 wwqxp

explained decrypted filler

seed 487

Metadata

Post ID: wwqxp
Title: 201207202348 → 2012-07-20 23:48 on A858's clock
Posted (UTC): 2012-07-21 03:45:57
Timezone: UTC−4 · title 23:48 against posted 03:45 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 16
Filler GUID seed: new Random(487).Next(9) ✓ verified
Run: Run 17 (seed 38,757,453) (seed)
Draw: 30 · predicted N = 16 ✓
Machine boot: before 2012-07-11 16:41 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

86B9AEA5541B5DFE A885703D225144D8 7590695AFFE841C3 7B79E72A2AD537BB E0985B3C7F866AAA 15B3E0845377CC89 213D19A7D81CC24A 5C96E472FA60CDC5 ADC60C10172D01E9 9A05F0F5B6DFDC43 24BF38E9DFE37E0D E1C92195A246DAC0 14F4F83FF40854C6 1CADF6A2C1031A0F B5E622012A1DCF99 AA4DB611914B6319 7B02BFBF2E243C92 3B52627236C00C28 4B7696D5A39D35DA 368DE6E736C70C54 5F7F854C05321ECA 7A25955459C79AB0 B9591932C6581FF9 2BBC8D7706D4042E 3F786401CE1630DF EA24FAB02CACF79D 5433BE7011C14A81 2F23B96720D86DCD 7783A3C7742E5729 AD86EEC077466D9B BAA2016DB9788726 6ECBCA48065CB5C5 0D95A96FF00648F3 950CE0F770B1FF52 23E37F7D7F84931E 7314FA717AC3D50F 17CB35F3A857E221 B41C90C75965C8F1 9D36365EEFE08078 A6EEB48EEA024051 B53A6085D2528412 24F4B7B01D52C57A 4A2389FE580D6D90 F0C356239A6B7D29 AFDAA02128468924 3D3209DF5F554B1C 639892CD310232FD DC790B24453DD047 AC86263F1747DF7F F14333E7571102B0 CBCC3E5F3C961897 26D58D97AA2A0089 0E27F466B8F2C892 AB8CEE9E4C03A3D0 FB7327C178358296 BA04B4603EAB6363 E2BACC77649825B0 728DD34DC29430FB 5AB3908F80C4F681 D1BCD887965FF748 0D030F60A19EF409 69D5C0E7A99A9FD3 241B84EBC999066D 19BF5B6A599F7725 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7bad839d-cdf8-1e09-b62b-cdb6fb5ce21e
  2 8b858ff1-a36f-6fec-8dbc-016ca9a11090
  3 24b3cb6f-c816-111a-80a9-d55668ba0e18
  4 ca1470c7-cebc-43dc-8001-60fe0d720677
  5 f52c9db9-d385-0991-8bb8-c46f2becfb80
  6 b9fd0c9f-e1f4-1770-9b67-1632824c28b8
  7 5d2d10a6-a2fc-04b9-8604-e5584a850826
  8 be0c921e-b1bd-6dc0-b327-d0b20412297e
  9 6f6f7d41-335f-2391-9289-a6e798ff88ee
 10 7644e54d-3db8-7188-b05b-2b68754a7c1d
 11 bc33690b-7c13-0ce6-b4a4-f1447d973183
 12 ee3e6909-8910-6f35-8b64-7d1ec54119af
 13 a72a9a0c-5efa-3ea1-8167-e952477298b0
 14 c63f7c69-7f50-7db5-af56-e7d20ec13255
 15 d3cc382e-4b2f-7954-92e5-32b18dcf9d1f
 16 49283c7d-b36b-1060-bfe1-3a9457dcae07

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1614010627063771. Exactly this sequence comes out of new Random(487).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 30 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related