201211081935 12updk

explained decrypted filler

seed 93

Metadata

Post ID: 12updk
Title: 201211081935 → 2012-11-08 19:35 on A858's clock
Posted (UTC): 2012-11-08 11:35:26
Timezone: UTC+8 · title 19:35 against posted 11:35 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201211081935) = c85a770d6a46c8ca6da5f978c84cd5e6 (name+title)
GUIDs: 13
Filler GUID seed: new Random(93).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 115 · predicted N = 13 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 12 · 6
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3C969661CE8CAEB6 2A7DC8966561C185 5D536323B1C47456 1971875DFE9D92CD C33BE175D28D2FA7 0B85851B8120C31E 5F45183FDCC74841 EC749067F57E3129 46607937413C2282 DFD17FA56AFB8C11 CDA482D2F2F90343 44EF181C82B29AB1 B9513B625153808F A8646DBD73C7696E DED546DA0D236F12 7A86534FEDBB9F1F 17758FD278599F0E 71BFFCF4F2B4AB18 A47990596DD8CC6E B23EF7E3032D2F82 B0833B8B24F141C5 1FECC38931C2369C 1F9E64F1D70B2649 17CA4FFB16DCECC3 1DCB18623E564ECC 85457B5DEB829D3C B8E9FF6A216D071F 413E6DBB0CAD36C3 68AE8E9260A24DA5 113F1AF2166DD945 29E2F81972CC9258 B1BDCFA06E5C5EB4 08D575D0835D0F4C 4EDA6CB0060F8174 2E8715B01C50EFB8 1D314D5E0012E650 1E7BEE566473CF86 83DD70D901437945 413629FC44692931 ADA418593F00A2C1 42A002E5CA5FDE02 95F4C6F0370D9304 8746C9F3DB3511BD DBE4AF2105BAD586 87670A0D4667D1AE 4FEFAD651FD456C0 2D51AFFD6876BA20 C9BBBCC88050CE02 0F680E23D5D77581 9A0820C8AE25475A 368BE4B6ACC6CFA4 033F439CC29303EF 523D3A2C1A60FA0F

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201211081935 (name+title). Key = MD5(password) = c85a770d6a46c8ca6da5f978c84cd5e6, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 04cf5fc5-bda1-25f8-a71c-7e0e4eca8908
  2 dd7f1f6e-ce84-09c2-9a98-f5299f933a0d
  3 bf127385-d0d1-6176-a9b8-f0e566b89c3d
  4 53ff265a-42c0-3145-b86e-fb80bb188130
  5 7dac34ce-05c6-164c-a50e-3187aaaa31f5
  6 c47ef509-3d1f-7e84-9777-e4e762657135
  7 fc043eab-e0b7-54a9-99ff-37a0314d2163
  8 fd8e8694-fcc7-0a37-b5d6-eb692960b309
  9 a641c62e-d9d8-48f5-96d2-ab3047c1e94f
 10 2a7c3067-5ad5-56f8-bf50-64980968b706
 11 c7f50207-82a0-7eb9-9c59-78cc474c7e1b
 12 28ca5f56-a4e9-04ed-bca5-68986d867488
 13 083be331-e08b-5d56-bf7a-6751e1323da9

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2063175045705. Exactly this sequence comes out of new Random(93).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 115 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related