201211081925 12up4k

explained decrypted filler

seed 220

Metadata

Post ID: 12up4k
Title: 201211081925 → 2012-11-08 19:25 on A858's clock
Posted (UTC): 2012-11-08 11:25:25
Timezone: UTC+8 · title 19:25 against posted 11:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201211081925) = d5cb41a6f58f6858ec50d7de3f647ed1 (name+title)
GUIDs: 15
Filler GUID seed: new Random(220).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 114 · predicted N = 15 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

020FCF595E46C737 D91A1EB98CB37880 3FF7F6AE923BD9F6 BD217F86AC9BDB04 95A78595806E0080 5CE99228EEB44613 241A43793F7EB104 D94B570D8EB7B29D C008CE06A9411A33 B166F1ED299DE91E 20EF07859DF336BC 1A02937487A8C248 A65520A1613A9262 7F6E4199924EC8F9 2A68567F971399AA BA83FC6F4BAFCE90 4AE970BCD8412AB2 E20ACAEE43833F27 64415C631AE848CE 8A1C6EDB8FA4B82F CCC412A7936EB496 CAE39C2F39A68AA2 41BDB85198031A2A 03EDBD44E2BDD4CB 67DA10D77198D85E C1FE17DF62022BD8 B492464966DA7F2B A1BF43D36612E46D 29845469A9CED8C7 4A8BE75D1BEFFEA5 C870198B2756253B E0CC2AC5C9A21F45 B0A956FC06838CD4 AD4BF7A2E8E0183B F8042E4DEB01AC2E CC4FBE4913B2FDF7 E9A53BE2B3FB8F56 4DB4460DECC08FC0 C9C4AD84E45D4B91 29150F12D13195DB B6C5997A6FC7F45B 7DA7DEF82D247B00 078CCBFEA42D06E2 9FB589E17DD941EF 9423CAAF6A6774CC 0521B259CA176AC5 BB9AAB15E99E164C 2C2906C6C0DB188A DC0CF2B93D349A73 ED2BC652A61D7DB7 D92F0470E2B69777 F6CE6E82D8BC9CA2 D836A1281990539F C4588B594A11CF48 EDDF9F98ADBE7FA2 B2FF0942B8851E1A B26FF79156097246 F50183406B208D2C D4DF519D89F471F6 04FFCFB09C30EDC2 BD8EDD45593A80AD

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201211081925 (name+title). Key = MD5(password) = d5cb41a6f58f6858ec50d7de3f647ed1, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0bcfaa3e-9fe1-5217-9b57-3baefcd91851
  2 098465b0-77c1-31fb-bc0d-351ce672c796
  3 a00bb029-4377-4331-875d-09b97d4aaab7
  4 9e263f5f-c49a-4f3a-9ca8-dadd33fd990f
  5 37ba19c1-7c90-4195-8b8a-dd3381af2924
  6 870a8a9b-f7d6-7e7a-962e-2c534a758540
  7 a3e531e4-a6c7-470d-84e4-bb73cf4779cb
  8 2a126230-4cb6-7579-a724-295062e98632
  9 eceab246-2660-18fc-a7c8-511cefe71a95
 10 6dabea78-f94d-3309-b347-046a60d23c85
 11 e172bfff-515d-3d9d-9c6d-aa4b42e1b76f
 12 00fd1842-c730-2832-a14f-7397069b7a78
 13 f9128064-acf4-731b-b18a-7d3d3a21940c
 14 d9382c7a-f44b-880b-aa40-86969ed6b5a5
 15 2b388e62-6e7b-83f4-93cb-245bea8dfd72

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 534447471332788. Exactly this sequence comes out of new Random(220).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 114 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related