201211081805 12un6y

explained decrypted filler

seed 484

Metadata

Post ID: 12un6y
Title: 201211081805 → 2012-11-08 18:05 on A858's clock
Posted (UTC): 2012-11-08 10:05:20
Timezone: UTC+8 · title 18:05 against posted 10:05 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201211081805) = 17fdaf23bfde48a4e4c404b2febeefe1 (name+title)
GUIDs: 11
Filler GUID seed: new Random(484).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 106 · predicted N = 11 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

94E0C6D992B2FC13 FF8002C96196FD26 FBFF68647D6FCB24 F0362588A934D873 325ABB922F03ECF1 2146A7249C57FDB2 5714DE32698DCC70 13AB622E3393D78A 63481EAC642BC76D 5604283FB1F112CC D7A2A18BC27FDAD8 DBD82C167A6CF332 9EA7E5BD64AB1077 E7C11FA80B5E686E D962C8776DD355AA 79D92F92FDDEA7F2 64950E40019C7ECA F675B9838BA07EF3 8F49880851D03587 07EFFEB27E84968B 09587360A77BF71A 909F241F26C338BD EB02A6BF50F457E3 FA02C85EEC8888B2 32E345B439B11FB8 A7852DB2EEC5C748 3CB5532E86467237 EFD2BDE4B44BC6A6 B9FCF910DCBDD671 D3699AAFCE4FB13A FC5D535EF11C01BF A5397772A2B1FF67 BEC3D9BC3702FB3C 5E7A462BCE9B4DCF BEA9880CB88CC29B 0E358384224E27FD 689204752246BB5A 1CD276114848D5B9 F8EFB34C8C97B441 04F5C68EC415C8DB C53DDA822B2CE42F 03474733FAEBE22C 204675668A72C244 A1EDB59AE2832222 82359288EA9959C3

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201211081805 (name+title). Key = MD5(password) = 17fdaf23bfde48a4e4c404b2febeefe1, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 91197225-b5fa-5be3-82ad-ed48d922b659
  2 2f6822d9-f691-771f-8cc1-1fe48bc30f3a
  3 a37de969-3242-0e5c-92e0-98adaa8a0b10
  4 5627ec3d-c5d6-7b4c-bd0d-8312b0d02f34
  5 76b721e9-579f-6133-8889-b28109568eb0
  6 1e47115e-a13b-416e-9d3a-8596075fd114
  7 1ca419e8-8680-69fd-b723-e0934334c3bc
  8 be36fe8e-96fe-2ddb-a94e-36c8f9be2747
  9 59274d34-abac-7f8f-87cf-9b1912612c57
 10 7fcb0d62-7c66-6f54-9127-0cc71f1a2860
 11 8db015cb-0362-763d-9984-e73b23fd8b05

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 57076462767. Exactly this sequence comes out of new Random(484).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 106 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related