201212070200 14e6tb

explained decrypted filler

seed 894

Metadata

Post ID: 14e6tb
Title: 201212070200 → 2012-12-07 02:00 on A858's clock
Posted (UTC): 2012-12-06 18:00:19
Timezone: UTC+8 · title 02:00 against posted 18:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201212070200) = 7936ed8822b7c1db183a685faa9da789 (name+title)
GUIDs: 18
Filler GUID seed: new Random(894).Next(9) ✓ verified
Run: Run 39 (seed 1,106,402,812) (seed)
Draw: 71 · predicted N = 18 ✓
Machine boot: 2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C1489582602A141F 82F9E96B42180414 3A62DBF6C60E148B E18DC6C716A13B62 2AA12E3FB9F75075 619B96408CAF6D53 1E421D112685BA19 50F2A748B89D33BA 5547903E2E8C7A54 E8CBB04AE1936618 AB96AB34BB275FA8 C1F0EBF873B5FB0C 8D4619F3C5C36000 49FDC08D7E5BE64B 3428CB8D52032237 363ADBB3074B05A2 867A59788D3AAD4F 13E7410E75D20860 65CEA693CAEBF86E D4E090CF80701587 E1F015D43DEED76E 02FB7924F810D220 74034E01BA212048 1BF928E8830532D8 D10BA889A5AD871D 714074C669D0E244 22E8402CDDCC0114 78077FE2173936DC 4D8F25C8BAB74605 24517B60EAA751FA 771C10B4CA386B18 EC7EF2944598C277 D412A77811E52079 DA945244C4FCED52 1C9D7D689665611C 613BAB86B7C9BFD1 179C199CFA68D08B 6083384EEA4D1AA2 3744F607A6453F12 237485EC039DDE57 D3710B40D0CA24B8 D2DD3609DB0F1EA4 6640A8247139EA8F 0CAA1E4157C68B41 11756E9E3114D481 0756846CFD1FCB12 A2AA2D7BB707C8DE F7CE3088A040363F EA9C106E59941472 7A9C73441271AF0F F404D098CC5E0313 B62AC7023A3EC5D0 AD4446640C9D0513 70A2CF1665510DB0 DDA408EBBE055EE4 68FED328F495F346 E1999A16879F8953 AD1A8BD9D549D2E0 E5DBCC098B5E1D52 D8C8E673E85AB719 E9C398A666D91211 9E44BE34CDB2EA25 91773C4D0548C7AD 0CDA97A8991C1164 AE70DD6B1A162C1E 2721ACC0EBA63882 64EF38EFD141D9C0 BCCC75747535289A 300EADD7C40565DA 1F203D7D1D46D724 C9683173E7D0A714 FD5A155392D0E16F CCE6BEB482747D8F

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201212070200 (name+title). Key = MD5(password) = 7936ed8822b7c1db183a685faa9da789, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fbb3e55d-3477-6c93-8d4e-248e1b0086a8
  2 d14dcc03-7368-1378-a158-826f0e43d0db
  3 ea92a6a3-1bd0-5dac-a4e8-0d802202181f
  4 d602ba65-1fd2-3ab3-925d-2f64fc8773ea
  5 542b9acc-d6b8-7b96-9170-eb43c62341ac
  6 d653dd8d-b381-7d84-a2ae-ca873ef7811c
  7 bf78ffc2-970a-40dd-b9a0-5e7cc0cae8d1
  8 2228b404-7b67-8dbf-9720-e5ef2c40a817
  9 d284cf6f-ac68-5864-9750-664d8643f4cb
 10 ebb64457-09fd-8107-a5fe-52b0fe843165
 11 d0071cd0-8c20-8c74-a8e3-13ea75f5fd05
 12 6860343a-1408-37cf-a4d4-66532b5ac2d3
 13 db00f1c0-faba-162e-bb3c-b975ea2dd92f
 14 ec1c67f1-110f-587c-93c8-203ebe00a335
 15 b1e9b0a2-9c0e-6f62-b26d-ac7aef75ff27
 16 8585d2ce-04b9-362c-a574-914c550bb632
 17 7d426669-f4a7-597f-8323-a5ae75ae444d
 18 d22c64d9-99b2-264c-a530-1d3887c1bfc1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 615377485883156352. Exactly this sequence comes out of new Random(894).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 71 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related