201211082145 12utir

explained decrypted filler

seed 680

Metadata

Post ID: 12utir
Title: 201211082145 → 2012-11-08 21:45 on A858's clock
Posted (UTC): 2012-11-08 13:45:36
Timezone: UTC+8 · title 21:45 against posted 13:45 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201211082145) = 0c828ebf95414307a23ca883bbc4e2ae (name+title)
GUIDs: 10
Filler GUID seed: new Random(680).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 128 · predicted N = 10 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 4 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

AE3B9FB9CD45E02E 468272514230E78C 97720A81A177DB6D 9A0337D99469552E C908936A58E0AEEA BCCB8A15C9C6C656 DC9DB0491979F197 1237233E96C965F5 1D8AFA03FAF2B082 412DC0ABF6594361 5E5AFF6A21996C6A E6D86DF7B930B8A4 4633CFDE50E23E5F 5A610C7ED8F1CA35 E99B34B06F72245C 7F869DC104EFBD4E C2A1EBAE07592894 12F13FD9A5B40A8B D8EFE692F362EBAB 6AA68F5933B63314 1290ED2F85F262DC EA52143D83BD9A6B 5B7D53226E8B4F6D 7C23D5CEC6A8230C 67983A78459ED820 E9EE2F0A22277135 C3AD76A8B145B951 4C9E727AA2151D47 E0B9364427D16304 4DE549C9D400425E 47B6F6297F6955DC 719A96B50BF6D14B CC6E8DF84D403477 891C047FEE946A85 0038A28CF10B05EA 5EA4DC6C9E8D3586 AECE2306BDA015BB 62D75DE426361B36 BC11B6FB3C6C5B17 6052AB7F197E2228 6D3FFB96C9F68CA7

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201211082145 (name+title). Key = MD5(password) = 0c828ebf95414307a23ca883bbc4e2ae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9026ca00-f873-8ac8-817d-828a52a11358
  2 a6f16d53-fb5e-3bd4-83c8-e850272940f4
  3 17906052-2e44-0136-8090-d38f83ddc65e
  4 0b0e8a90-d889-698f-afaa-b393b4784961
  5 28257a4c-4f5d-1588-8dd1-ea1fc38f3598
  6 2ad6dd2d-d76e-7a5f-9713-034e014093be
  7 0708a41d-7227-507e-a623-d4615d815c29
  8 506a82fd-ef9c-57bb-858d-c8420d9165a5
  9 28606baa-0f88-0122-8ed0-4f65547fc652
 10 802fd790-06bb-02b0-be42-63bb333dae4c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8306175500. Exactly this sequence comes out of new Random(680).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 128 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related