201211081955 12upxa

explained decrypted filler

seed 758

Metadata

Post ID: 12upxa
Title: 201211081955 → 2012-11-08 19:55 on A858's clock
Posted (UTC): 2012-11-08 11:55:28
Timezone: UTC+8 · title 19:55 against posted 11:55 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201211081955) = d1690e6b32329afb7acb6d00ac16cf8b (name+title)
GUIDs: 13
Filler GUID seed: new Random(758).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 117 · predicted N = 13 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 4 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

48122FCAD217E641 9F555A05A4B59186 38902A54578DE5BE 89D862AEFF70D7B7 928D579B130823AB 97D09461EC56EE77 BFA38087BC65F4F9 DABA82BF61374533 EA29F6E21795B9CC D758300DEF4E88CB 115DB58E4D39F2BA 361D5E2B50A26F51 C4B34E2682985545 4EC0DA417D697AAB 41C1D4DD185B80C3 39EA20C6EBADE0E7 80C84301A854BC9E CD31E619414B5C10 96CE2AEB7C473F7B 3F6DFD0EA5D1B900 27C2504B7D08E704 18AFA34C5FBCBB57 D41AD79527EB05B3 D14698FCF6CE2590 91328977609FA130 279CEB244E5C1D79 51B353E4EAAF8F5F 9D3F5CD3049DAC23 0EEAE0641A14FED7 F9B604F2B9902695 BEA67629B232C0AC 2C9E00E57E66B1FA 51235B87A2ADDF15 98218CF892D59144 040FEDB98813D4FF C7BEF2F51EA23A80 9337ECBCE5CE5E3E 308E679A86D058DA 722C33FB846CCA0D 4CBD64FBF866F8A4 76D2B94B2B135602 FBE45B392C62D60D CDA146F1F7CAF3AC 01A6B731A97ADF19 DB9763ED177A91B5 EEE40C986A4BC66D 2A4A7620177F1757 951644D65C8CACF9 74B83E8736EE9672 059F79E71354DF35 44AD95FC728C6545 12C60DC90E79198A 38D22126B9E7DAD5

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201211081955 (name+title). Key = MD5(password) = d1690e6b32329afb7acb6d00ac16cf8b, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6a2ead2b-f1e5-67bf-85f0-e4e3261f8650
  2 e31d93a0-00c7-2ca8-b9c1-a12edb10a908
  3 6140dfea-23e0-5829-bd33-59f7932b35ed
  4 fa2c443c-589c-39e7-a933-f79252208bed
  5 32316d46-8301-3445-87f5-246bfbf4c2bb
  6 69aa87c0-9902-8f02-af93-db7569174129
  7 b00d6b5d-7465-4c8a-bb95-a57aebc0df92
  8 7ac3742f-23f2-6ac6-99a6-1419833b58fe
  9 fe81f71f-0d5f-67d2-a9ff-cf76f91d6c5b
 10 b0f43c5d-fd55-7d71-abb7-153ae1c0c2de
 11 9128e9ba-ae8c-63cf-a5ad-86e0ba134695
 12 81235c02-de1b-20eb-8975-e3e302a41268
 13 c54e1841-6ba4-6ca7-b0f1-362f280b44ff

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6253384667626. Exactly this sequence comes out of new Random(758).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 117 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related