201210311459 12evnp

explained decrypted filler

seed 531

Metadata

Post ID: 12evnp
Title: 201210311459 → 2012-10-31 14:59 on A858's clock
Posted (UTC): 2012-10-31 18:59:59
Timezone: UTC−4 · title 14:59 against posted 18:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210311459) = 3c876056a8971059e0f26f0180fb34ae (name+title)
GUIDs: 14
Filler GUID seed: new Random(531).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 69 · predicted N = 14 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 14 · 7
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

04BD42C9BB72BFC3 E1ABA71C8FD9B6C5 42FD1C2758CBDED9 C95112AD8008B77F 7DE377588ADEE362 2B495EC6C9425CCE 4F549784E44F30A4 447D2FCF680F374E BCC5130393B7D2EB 2C0A23D330FC8186 B48048B89CFFFCEE 43671BCC500B648A C17176AF94A01431 989FD5472C47BF69 3BF50732D6960D73 B40950F0C29D0C8F E66C37D68AC5ACA6 40F1D875FEFDF1FA FF3A20F65C741A50 A386C66EA5430167 0B2ABF9ED86B8D24 BACC9699E749A299 98945C3EBD5626BD 8975EE664D1B0901 DF659D109EED6C35 4954E462E8FACC2A BC4602D1C20D22CB 1681C78CFCEAAD20 3936A096D044D929 7B00318DE183DD09 F4C56672A9D7E14F 2E98DB8458B38063 0AF0AAC154A3EB94 6FF4F97272C09BC9 1278A515DCA9D6A9 BD39B414815592B1 DB6576287BE75DCA 66DA3ECDE61988E6 B1EAED3B7241B17C 74A93299C29C0C67 16402DDDE9A25974 F434AA6B67F62C76 1A89826749E3EFAD 049F8ACDDC6B533C 3214320F3F1AF2B2 3048FC530ECF3741 F2B19787473B03C9 74733251A16019D5 D692DE1FAF8E0CD6 A4EB3C6A903F98E4 035220F9578D8324 EAA159C7C35CC1D3 44ECCCA83F61D818 FF3E9CC4719EC07C 40E76AEFF2DD2A6F 67FC6431110C8BA3 A220683A03AF3255

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210311459 (name+title). Key = MD5(password) = 3c876056a8971059e0f26f0180fb34ae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 dfafbd90-03c6-1b62-8470-fc1918db19bc
  2 cf5015ae-53da-52a0-b7e0-2372f28b6870
  3 e9ce0fc6-81ab-801f-820b-0266f23c23ed
  4 18e55029-b5d0-8e55-b354-36af3156571b
  5 b8212d73-8d80-8443-ac68-16fffa97cd70
  6 f36d9088-b84f-5e91-b0b0-dc85584b6287
  7 1ae712be-e173-78ae-b2e6-828bb7297b59
  8 3417e772-d957-75ed-b82c-7347912dc9e1
  9 1cc856d6-bad5-6532-bb27-a66b3bc0d350
 10 481d0b24-e5de-035e-afa7-8b8d922677d5
 11 7fe997f7-40b8-4116-ae6a-65fabaaea510
 12 2c538bec-d0d0-02c0-90e9-c7d9ff2aa3c0
 13 c148d44a-860e-6059-959a-7cbb7fad01ec
 14 ed8b3328-51e9-6f89-955e-3f8ad6e870f7

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 15888577604066. Exactly this sequence comes out of new Random(531).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 69 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related