201207211314 wws52

explained decrypted filler

3DES(name+name) ECB, 11 GUIDs, seed 394

Metadata

Post ID: wws52
Title: 201207211314 → 2012-07-21 13:14 on A858's clock
Posted (UTC): 2012-07-21 04:12:00
Timezone: UTC+9 · title 13:14 against posted 04:12 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(394).Next(9) ✓ verified
Run: Run 16 (seed 39,036,328) (seed)
Draw: 33 · predicted N = 11 ✓
Machine boot: 2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

2A49285DA029A669 5451BF9D224E7C21 82843405C708A8D9 34A234A296DD094E 6351BC4342523757 61CA1AB62BCD4FCE 8BD58FAEBC4A66FE B3F0E66A300723B0 C636D7E40563138B A610C336F0FD9670 C147516733D77892 9C1798B7BDABAA4C 098130450CC9E90D 519FBF83EFEA8828 B9D0E287A0F263CD D6BCD607FED1699D 9E92C3200981C9B2 999DE1283F2A2E50 59530CF89D366D66 E0D5B5DB731CB3A3 97C5C4AE3518DC92 7E7F5230561BBE19 C5BF2C7A21307637 72272DF34286ACF5 2E6789570C25D416 1FD73E43EC41F8FD 36B1847F92715179 DBE4D31EFC1F40C6 39F17731BEE74E14 A506120A57E37D15 13F42A4BA873DA27 EF8558B4EEE8E211 DF1D72B02E913477 F7D6EE2E52BB8657 A3D588DA3C937C49 D89FDC6E97BFE4AB 55012099F53ADB30 E2723D3CFF586479 A78782142DF547F0 2CDF1428D438659E D88230EF383C2CBB B34A66025F6E2293 A3476909296B28E8 02095909566D1ED5 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 607e7679-154c-501f-a44e-34d666c505b9
  2 9ff6f7b9-229e-3a72-96f5-07ae8d054b4c
  3 322981ef-c661-183a-86c2-df664514cad1
  4 7a255da8-121b-5de4-adcb-5991793c53f3
  5 3e66d724-2ca2-04dc-aab7-9217843282a1
  6 158f4b40-2720-714b-9679-b6bb9003c19f
  7 3378556d-644e-3959-89f8-d9db60dcf567
  8 b0d5ca17-d3ca-03d0-8a08-ec38df1dd0be
  9 62d19d78-d468-6a24-afa4-54f25ba3a96a
 10 1d29ea8b-bcb8-574a-94bb-f94e5cd8cf58
 11 ffa38d45-5321-5fb6-b038-37ca62ab3953

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 53150730655. Exactly this sequence comes out of new Random(394).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 33 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related