201211081355 12uewi

explained decrypted filler

seed 928

Metadata

Post ID: 12uewi
Title: 201211081355 → 2012-11-08 13:55 on A858's clock
Posted (UTC): 2012-11-08 05:55:03
Timezone: UTC+8 · title 13:55 against posted 05:55 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201211081355) = 22732cec832ebd249b7a0e45178ca593 (name+title)
GUIDs: 9
Filler GUID seed: new Random(928).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 81 · predicted N = 9 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

65692519574DDE3E AC33BA2DF07D6049 0DCC74AA0E2B2641 D89C08C932F78A5A ADF8D3FCEBC8C393 46CDD4DD45117092 2E9454C68CFA7878 C07B7DA3C0115BF4 78C7D3E74C62C6D0 B022BF057A77FE0D C5ED0A608759D332 E7C5CEB1DAD2596B D1DC3863CF9E0A44 536E70450285427C 5BBAD3AAB4F791FB 867B1FC94E5D06BE D517EA03587FDF23 66613C8F81E912DE 40DF89CF495313CB BA09D2FF59D6C11A 63BB8277BFBD0A62 1B6B25966429B427 9F28C4924389DEBF D243B21A88C440A1 516EE7C5DC434F95 97DD307603091B6F A86C521F2D390972 CB63A0C7447420AD 0CC1144DA484756C 6465F42D9BCCA4F7 47E23379BDDBA988 46E16083B21ACD3E 2A2C9AB1C3B217CA 29EFF402AFDE1C47 783735E34D305387 ED54A8CC41F30EAB E7CBFAC986921E1B

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201211081355 (name+title). Key = MD5(password) = 22732cec832ebd249b7a0e45178ca593, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3227992e-b706-4cf4-94ee-bb1d191ef90a
  2 f19e4481-6808-0f03-8483-b5020e207711
  3 ed290d44-dcdc-30b6-b925-61b763758145
  4 87061356-78e4-5a10-a36c-7eb6155bce71
  5 61f06e8e-8daf-1efb-b1a7-1c3949710cc1
  6 9e61b053-1b6b-434a-9deb-00ac32a94f8f
  7 0f03b538-33cc-6291-8b9e-c08edcc23349
  8 0fda3fed-08fa-0372-8b4b-b43c39dd019b
  9 e23d717c-d026-7b5a-9929-74511e107c45

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 403514607. Exactly this sequence comes out of new Random(928).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 81 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related