201211081655 12ulci

explained decrypted filler

seed 153

Metadata

Post ID: 12ulci
Title: 201211081655 → 2012-11-08 16:55 on A858's clock
Posted (UTC): 2012-11-08 08:55:14
Timezone: UTC+8 · title 16:55 against posted 08:55 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201211081655) = 16c687c782cf3bab6d626df5decdc675 (name+title)
GUIDs: 9
Filler GUID seed: new Random(153).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 99 · predicted N = 9 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D7445BAEED98FB58 B2BE7AEEDFAF35E6 6FFD2A248DD1AE8B A23E2AA43A14F1D7 8D1E3748B897B21B BEF20133D72C8A01 47AB8CA517511656 56DEF7F1BF4061B5 A699FA8991A16B98 CDFB8D8E049DAF62 B52F7080120E0179 8C98D0A8FAC9521E 4402BB2A4A4DA2E6 DCAC8F30FDE81C84 A6C447C9D3DC698A 94891CDF51C5A8AD 3CFFD7285EC33C59 F1FCF544771D5BCB 8EA4DC6076160408 2EA721482EEBE7C7 5427FE5A11607597 43B8D43EEBCEB92B B195FB50021A6790 28DEB3482711BA54 47F4025BF513ED33 9730F89C53D2DBC6 676446629D71D9B9 9A7DF1A7992C4E6C 5B5F1ED90A966FB1 4C2DA3EA51E061F6 3E56B40EFF6D8356 D5708FCB7EF5D7A8 2EFFACE3DD642C4B 5B92F454EE9ACFF4 FD03B4B9B530A155 1DB5CA2A184D32C2 4F0FEEF4FF84C61D

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201211081655 (name+title). Key = MD5(password) = 16c687c782cf3bab6d626df5decdc675, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9f986cb6-721f-56b6-bd1b-9297c1808825
  2 514c1e91-eb22-6680-bf7f-3b6c64aa0ee3
  3 01d22988-4d2b-6da4-bc13-768cb5bf235d
  4 b6609fc6-08f6-1347-bc51-610a931f3b88
  5 2962c1a8-4484-267d-ace6-ed2bf0026f73
  6 1827e703-8a27-2de9-9db3-7bec2741c58c
  7 d61b7b1a-6cd7-4999-a828-57169a16a9ac
  8 4ec486b0-0440-1a81-85d1-d335e43b1637
  9 c62ad374-1913-8fce-9fc1-99cd215768e1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 566122418. Exactly this sequence comes out of new Random(153).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 99 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related