201211082015 12uqix

explained decrypted filler

seed 520

Metadata

Post ID: 12uqix
Title: 201211082015 → 2012-11-08 20:15 on A858's clock
Posted (UTC): 2012-11-08 12:15:30
Timezone: UTC+8 · title 20:15 against posted 12:15 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201211082015) = feeb28b4536c4f2c1cc9a8d6b26d0bbb (name+title)
GUIDs: 15
Filler GUID seed: new Random(520).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 119 · predicted N = 15 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A7AB31B7E9BFDE44 BE496B2B59ACC39C 1FCCABC817B00EC6 F2501B5E3B68BD5C 5A0C811B2D4745BC B4446A68A6D46B25 D2BBC27D3669A0F2 3A99606D66D77E94 0F85F07DE7EA781C 8537AB23941EEBC3 2C8A2B46C2B25F9A 86E2ADCBC46C46B4 8AB49CF8F9339798 DD8514DB3D9F25AE BC65705AC9901115 900A2B8F1F29ACC5 A5A88A397AFCFEA2 E49C1E7B214F344E 5606E15325607457 CADD1ADB91C7F9C1 CCC8D5D7A649E1E6 F2C49CDE0FAB39F5 9C55423E62DB155A 5B436D002C2050C8 FDCBD6D2C4C1BBBF 34AD2440E276711D 76119DE072E2ECDB 5B6C5DCDC5CC81FF 87990236BA705459 43F1BAB15F279C98 8C4EB7C6B819B03B A6CD31ADAB1169DF 996A307EC6E13520 45AFD714C233B2B8 F1BBF02C402F5AAF 0C131379CFBBAD21 904690EE5DACA90C EE943152DC2C72BB 94F210EFAD389E63 5953C2BAED3D2AD2 ABB53D5DA2B66F0F 412C7902BE8D5584 A937B1786BB6567C 4D7208017CF2361F B071BAD5BAC5630F EE9400A99074A020 BA1C6F9845A352E5 21F68CA01680E8E9 B4ED4D3B2D08D193 341EE94FB9177C0B D0D5A3BB2DC8B6E8 68F6DE6376E4142E 11A2C6FFA72FCF31 F4B776BEDDEAB1E9 D29811F033EDBB3F F58D6F2D5768FE37 95CF1D309667BEAC FC5EA3941DFBF596 53D9DFE20E750EE9 993FF9696A099D07 3BAEA1FBD59883D5

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201211082015 (name+title). Key = MD5(password) = feeb28b4536c4f2c1cc9a8d6b26d0bbb, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5e8992aa-5016-3178-8669-dfb457e9acb4
  2 0fb5f350-3402-3a5f-a634-d84eda82c530
  3 cf1853b6-c252-2b3d-8e8d-cda98c0a7abf
  4 7bba7eb8-dbc4-4f80-b4b5-c87951e3a392
  5 b54dec38-12eb-8cab-923c-1d16878146c3
  6 67d40249-525f-814d-b5c9-879115dd4da2
  7 31050e1c-0841-8d8e-b787-11b18cb157a1
  8 c4303701-7d60-275c-95b6-062471ca1c2c
  9 eb890240-1654-2929-a28f-91b2ea5dd935
 10 2d1c7a7b-f5df-02ed-9932-81b3f5e39797
 11 aaade11d-d8aa-3be9-9496-c20fa1e8db06
 12 61fdde6a-cde7-3011-b6a4-8fb3da5e4d56
 13 911dfcb3-0c61-0a22-a010-e17d431b2d72
 14 d8673cfd-fcdd-0665-aa04-0017e779a811
 15 7bf5148d-7832-8334-be7d-7c4c7121ec15

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 332488822033008. Exactly this sequence comes out of new Random(520).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 119 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related