201211081335 12udxw

explained decrypted filler

seed 30

Metadata

Post ID: 12udxw
Title: 201211081335 → 2012-11-08 13:35 on A858's clock
Posted (UTC): 2012-11-08 05:35:01
Timezone: UTC+8 · title 13:35 against posted 05:35 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201211081335) = e25567fc0611025679ce4d0db19df56d (name+title)
GUIDs: 14
Filler GUID seed: new Random(30).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 79 · predicted N = 14 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F94EB5BA4237BE0E 610905B9B47C3AF7 021326B9FC3A8DB9 E8D6A5853929AEFF 63C02B0471075174 59EC58BCB1A959A6 7C4121A82E0FDD32 521E46939F8D7AD5 094894E043BB5DBC D52D4650188CF53E 5F67FC08604E439A 234EF28DE24232FF 3127B8CED4144E30 F257CBCAD934E104 B49EEC33E03968C5 6BEB9DF49777312F EA4D3982B3DBCFEE 5415AE19F6F45FB8 ECA0D26E19153F3A 085990EC84926A2E 9BCC3C1EDCBAA2C3 6E6D88587ECB47CB B7B2DD5815463337 9C3B6F8BC9D420EA F81C04926E5D3337 F2A7734E07531F39 C8D4ADBF6A78CFFA 17DC046EDD7347AB F1E2EAC7832E0FE1 F9CC26F834AC1F60 A14B9CA8EAF1D9D9 0221A03EB67F6E4A BFC74786781BDEB9 6B41EE934268DD3F E1E90F1242325F0C 507007A272DB5CE1 3E61C0E9B908D980 BCDFE5B231FA67B8 6FE3A970E6D229FF D09342A078CEAB57 E33D59954FB9083A 7741456E40BA54CE 1DE216D45A5B4C8E 3809829F8B1756C8 0B70C2A9E2298975 91C25E9B8C773F5A E374F9C50D535F34 D67AAE4765BF8345 0C52A5DB4BE6B5AF DD7D47B79115ADAB 907B8059AC25CF7C F4E42E4594483365 6D64CEA12F15DFC1 08155EBBE234A7A2 A0F15B2861473072 D2C75FD8B7B3CBCD 4ADDE9F8E2973F8E

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201211081335 (name+title). Key = MD5(password) = e25567fc0611025679ce4d0db19df56d, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 60030ba8-af5a-3c13-a232-fe41b4646165
  2 c9105e81-a38c-5c12-a3b7-7e9393b9cdb1
  3 a480e4bf-4d4a-625c-b2ac-15923afd0a31
  4 f6155f27-acdb-85e7-a95d-454f3aa456ad
  5 91439e98-d5cc-6891-a60b-3a8a47571830
  6 4741912e-35f2-680f-a0e5-901eeb1a8802
  7 dd780873-70f4-3d7d-8aa9-eba126a0fac9
  8 12f472d0-fc93-4d70-b6dd-94010705cff6
  9 6a42698a-ec1b-60bf-a1b3-3dc9f1f2bb2b
 10 67b097ed-a132-3b29-9c09-3f4ae47a6d9a
 11 cac6be8a-9ebe-3c11-99ff-c29ae1d92fa7
 12 c158f491-b1a5-7d9a-9714-7bd0c666d7c3
 13 d9c1610e-df48-27da-86b6-1717700d2273
 14 3bfa1066-ad7c-07e2-84c1-bdee50f99f8c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 35686634633720. Exactly this sequence comes out of new Random(30).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 79 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related