201207210000 wwrhk

explained decrypted filler

3DES(name+name) ECB, 9 GUIDs, seed 956

Metadata

Post ID: wwrhk
Title: 201207210000 → 2012-07-21 00:00 on A858's clock
Posted (UTC): 2012-07-21 03:57:59
Timezone: UTC−4 · title 00:00 against posted 03:57 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(956).Next(9) ✓ verified
Run: Run 17 (seed 38,757,453) (seed)
Draw: 32 · predicted N = 9 ✓
Machine boot: before 2012-07-11 16:41 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

483E68C19316E927 97D53E64E92801C5 0024599D0DE7E8F9 3268114100C4459D B9F8C69E9B66B4D2 00D557FE1AFCD847 0630B8825A87F1A3 1A4283D4C98A514F B067B1E167926234 30C47C900EC2C202 714979F4607E18C7 CA27EA79DCADBA9F 52B45F11B9F5020F EDDEB889836D0335 A7BFC5E175320AD7 E182D001A91CF0AA 863606613EC79452 AC2A52CA2AAEDDDF D61328F578D1B39F B03D3BDE3C8D7703 988C406B44A1BD78 A2EE54E1E4FE0586 5D139B11D9232536 7AF9AF7703A733FB 5DB46BFC647E091C 01CCBA779C77B166 888DF879AA047572 CAEACE7365F817EC FA4A73C4C2D4711F E5422DA610FFF1C4 3BDC355BE9AB057E FB993CAC18F2CF24 497D39972D68315D AC8B1974A5DCE791 4E644D01791D8DA2 7875D5C914BFC242 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 df8ac62b-84c9-17c7-8841-3eef21ff55c7
  2 8281a0ba-dcc4-27c2-8fed-1e84e524943a
  3 f0fddd29-b290-0b2c-8a61-3dae79c1cbb9
  4 c9b437bf-913d-5e9e-9930-2ed7f9197a00
  5 11290d89-6acd-7604-b94f-b6097b17769e
  6 6c639bab-a366-06f6-ae6f-d9f938d55502
  7 8b0ab403-57ba-2f94-9f41-f6d62ec37ec7
  8 14320c20-82e8-0623-97ba-6ef4680f2bee
  9 708c4878-f742-2b7c-9d61-5fca46c12a44

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 120570202. Exactly this sequence comes out of new Random(956).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 32 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related