201207211329 wwsus

explained decrypted filler

3DES(name+name) ECB, 21 GUIDs, seed 631

Metadata

Post ID: wwsus
Title: 201207211329 → 2012-07-21 13:29 on A858's clock
Posted (UTC): 2012-07-21 04:27:02
Timezone: UTC+9 · title 13:29 against posted 04:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(631).Next(9) ✓ verified
Run: Run 16 (seed 39,036,328) (seed)
Draw: 36 · predicted N = 21 ✓
Machine boot: 2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

B1135E36B43D4C2A 971286B759256867 1026408F61170AEA E16FA6AF0B887B90 BA18A5E19025C244 3C7BCE843D86B6BC 8B78305845F23844 5BDE8FDE0BADD636 D01E19532E1F8EA5 CF355F39EC72B5D3 3C2ED0C61501C549 1B445A272B1006EE F005255F143CEC02 F45D18D3C56D9F1D 7556E852F7C827FB 5BC84E5082D1068B 7FAACE791DA78CF3 A7AABB1EA06A26F3 FB694468EA6896B8 821C9FF9F5D772CA 664F26AA64793EA2 DC14D36316EA0D83 586111D7AC77AEBE 97985C0ACC8822D5 6080069A0E389F93 8208CD10B715F4A4 A17452211E71DAC6 B0ED58F9BB2D3FDB 36A19AFFA791E708 5DB3D3FBCA9256F7 B5F03DDEF9BC888B 297BE1E96AB665C4 A98C43445D2F2648 D392CB25E2EF60D3 5C4DC5EC62D1A18A 00B5ECDBCA601405 6D4F350250EC1159 4F4FC05742BC2B6A C0AEC90E8D0E5D00 576AB022F6207647 5534E1D835E5E3E2 14E20187F98D3D4A 7F53A20D5FAB99DF 491D1AEA732C3EB8 B2338418FCAD3455 A52F9EE86E244955 24A3D091252D7FCE A1EB8116F65B047A 70A22C1814801310 66AC392C5A4F061F 6D61355C79777676 673F37AA0AF42A15 472733F545897D5D C355ABA4E9B31A7A 75CFE4E359D3B91D 0842B202F40E4465 16FEA8F540F6E9EF 1A758B38E44F49E5 C22CE83599C5E41D 2C8B7C3114998884 827432218DC064B3 C2034FF3A777DA9F 5B09FB82AF2E8DBB 7A0E1A5EEC7981B9 5647B13C450B96D4 EB3EC5D88BEFE537 C6CEF4A663823BBD D57DE75120E7C127 D7CA9D4757557942 8D8F47F91E1AAE7F 95EC39C0B750C0B2 B32A81A7D8AABBB3 B3AEEE0A8A6A2BBC D001543764BBE4DC 753966382ADED973 17AAC5B751E0C326 E1B75E48A72FE193 0DC4EEDA9F089B54 1024B945479B98FC 0B1BF79B11AD6A1D F4B44DC1740F228A AAE741AF1A0E3086 DF9CED2DDAB34356 FA4234B62C8634AF 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0cb880d7-5ed7-355d-aedf-979cc1016b73
  2 cbf74ff1-f8e7-8e4d-8598-a2fa5b7dba05
  3 f0b82964-6258-70ce-b224-a7e0b17e22f8
  4 5a12bb0a-e329-26f6-96a4-0a3fbca700ed
  5 2e654481-6074-0914-a673-48164ec7702a
  6 61056092-de33-8d31-bbfa-09ca5a8ba57b
  7 b20fe3d8-743a-546a-bd01-c8118d6ca651
  8 7f9947b6-67fe-0511-b395-47c03c840465
  9 062c27c5-1c65-077e-8d35-06af890a9a60
 10 2da14015-adaf-8828-adf2-5f50dd3fd801
 11 a2c80f8f-e727-1f8d-9db6-1db7d6d64795
 12 b17c3a35-eed8-00ac-8879-e5e0ec34fd57
 13 d7ce175e-852d-3473-8422-206ea332b47c
 14 00a9d196-2c5c-64d2-8316-4280c6817eb6
 15 47c1352d-8c3a-522b-973d-efe1ddaecf94
 16 db2ccaa9-780f-0e93-9b83-efd82db961d5
 17 617c0778-fd98-0629-9d08-cd6e12a0ca3c
 18 22284714-cef3-168a-81f0-d961225e702e
 19 51978d43-82d8-626b-9331-d19608075e26
 20 8fc9a652-f8e7-5be5-aa48-beb3df965b63
 21 9f9ae61d-6fc9-5c33-ab89-b340bd2085ed

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 387208500810365001655. Exactly this sequence comes out of new Random(631).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 36 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related