201212031953 148efp

explained decrypted filler

seed 187

Metadata

Post ID: 148efp
Title: 201212031953 → 2012-12-03 19:53 on A858's clock
Posted (UTC): 2012-12-04 00:53:07
Timezone: UTC−5 · title 19:53 against posted 00:53 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201212031953) = 22412adc8d4b81903706bf359273a07c (name+title)
GUIDs: 13
Filler GUID seed: new Random(187).Next(9) ✓ verified
Run: Run 39 (seed 1,106,402,812) (seed)
Draw: 10 · predicted N = 13 ✓
Machine boot: 2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

236CAB33428ACECD D69596F8CE3C0D4D 12667F997E38AE37 09D94CDB8C87EDDF 0DE545B495A628A4 8D3D6758CB870CA2 52A3E01BAFEF1987 A7766F0F00E608C9 E2980D1CC5B5BD8F 94067B883A66DAD4 00D2AD0F1029589B 08DEFE8EF07A9C15 15ED3BD623D9D0F9 27F8474A37C4C046 0AF0A65E87E1E01D D01236469975DE00 1E6CA4C02CC78BD2 182509B38F728401 49DF1663C3C91AAE 324F766074352839 D913AAC015BC3F0F 7611FF927EEAD103 8FDB0AA53CA70760 8E2E5E20D6B4B7D8 73140D0FE4BC22BC E9A6771215B8ACE9 C4F3D52038C77A3C A5A5730D6DF027EB D02A08506D0F772F 70E67551F49E6F42 65D70BCBE59549E0 126E58838471DBD3 A83AFA0094E2B475 0E370E16ECDBCA30 2F53BF08173B9785 239F46BC201908CD 3BB45727321ACF66 54B5A5CE4E776E6E 891A227142869D1C 47F17B105024FD33 9EDDBD7E845D3E4D 14602B0C6D86A15E 48A3CE8D30120823 70E22F0A49FD05D7 4078C6A87B9050F0 12C1616116556A1B 159537DBD40F782C F142FA30A500048E 2C684EF59875F7B0 A556DD95722A506E D2080C44C56AE33E F83FF1C4ACEC94E3 82E870C2851371E1

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201212031953 (name+title). Key = MD5(password) = 22412adc8d4b81903706bf359273a07c, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0605b2b2-2c1c-3d90-80e3-196d214570d8
  2 72f99c71-d71a-69aa-8713-4fe1821a1400
  3 fa904f76-53cb-4638-844c-2fed5594609d
  4 a54c77c4-6c7e-40fc-b59b-08a491023e76
  5 701ed5f2-f7b3-5a28-a28c-0001f3f68c96
  6 cc811341-a305-8d0c-a7ea-94d88f299315
  7 854ff264-c875-6668-bb7b-155c5ab80bb3
  8 3deb1282-b5cf-21d6-9b1c-2b9f6867984c
  9 45ba5355-cee5-1c81-8444-0e27130486a3
 10 17c33018-f3b9-2fa8-8c67-7183d366594d
 11 35c28001-5b2d-026a-8fa6-c1a5b6c59850
 12 f2e75f20-d6b9-4281-9b68-3ad8f92de7ce
 13 f4030e17-0b8f-1204-bd83-ab84b748b8d4

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3644586212041. Exactly this sequence comes out of new Random(187).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related