201212071600 14foej

explained decrypted filler

seed 89

Metadata

Post ID: 14foej
Title: 201212071600 → 2012-12-07 16:00 on A858's clock
Posted (UTC): 2012-12-07 08:00:25
Timezone: UTC+8 · title 16:00 against posted 08:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201212071600) = 29b88830c237cfd6f85ce557721cd4e0 (name+title)
GUIDs: 17
Filler GUID seed: new Random(89).Next(9) ✓ verified
Run: Run 39 (seed 1,106,402,812) (seed)
Draw: 78 · predicted N = 17 ✓
Machine boot: 2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D891B3BBF1218F1D DF8F11BF70EE0C32 48419A62C19B644C 586D3D3D71067CB0 B50B02E04A5FE334 6AA3B30B72779281 2825420301D82028 9D806FEE087FB78D 127FF82D92913CDB 63DC0CA80FC8E514 B2FDF1FA6B8307CF 2980E1AEA7AC408A 8C23E3F36D388E03 67CE7C8C33E28CF2 0402C20C41BE454D 270045CFDA8B7C4D 13C30350081A1B94 15B4B1004D12803B 06278CAB5D0520FE 2C81E464F15C832C 40AA0239176F030A C0C0A4B52B55B7C4 DC00F2687F541804 25E1B07264616168 E6834151038F5609 EB09AB6A309500C0 2450ED783C661121 ACB5C70686FD238E 59E4D2C9D49FDABB 94DFE5380C788228 8C94BF6137189817 1D422DB1A775FAEC 560E9C61733B4AF6 BDB08B571E479A10 4485059431BC0055 8C297111D0722457 C676725426DC0188 35DF9E61A107B44A ACB80E2587A60D0D B33168C40EB64513 D3A3D2611AADE8F7 639079DAB0F66D3F 0CEF48B244D1FA88 7FD7FF8075A7D4B5 DAFDAAF53A69E988 98E914D0E12C1FB3 7B212A02B5282874 2CD54C324EF00175 6606A560AF94D93F F2D0A8C3A4E5E2F9 295FDB4D232314D1 AF6B5E0FF8FFB0F5 4B02F50551E65F87 3E31D22F83F37156 A64A6D7F20007C81 F6630B3735410FD6 8D532A0000D70794 A893AEB4A6B0CE88 F38C0A76770ED863 29828E649C250A53 9637E66E84C10B15 DA09EEA30AC14531 ED90F46063873379 23F26275C3A8A012 4B7C14B351E7DD3E 18A9EBBEFAE0AD85 CC5EB6722FBAF1C1 BDEFCC0E37421902 786D8D3A51300771

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201212071600 (name+title). Key = MD5(password) = 29b88830c237cfd6f85ce557721cd4e0, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 754ec252-f6ee-1615-8a58-74e475dd9d4b
  2 a73ae155-ae92-80ae-b559-f24a0ab74642
  3 c37a93db-21fd-8019-9f86-9f2b360b1bc3
  4 02d6a676-69bc-46f1-af75-ddd12486d2ad
  5 12b02687-72bd-3a4a-9964-0d3c2cf2e68c
  6 062da76b-0994-3276-8dfb-a71166a87194
  7 2acc3640-cc0a-754d-b73a-0f7a9c31fdaa
  8 0f44aaf1-23b9-0ec1-a5f6-f84776b4f101
  9 251e49be-1103-81af-874a-6d5a02844971
 10 ca034515-809a-0643-a967-c3570912d0cf
 11 ad524ecd-b497-7a33-b7db-b507a82a75c7
 12 74441065-8dd7-8e5b-a6ed-c7dc33ca19f4
 13 e6c7aaaa-19f7-7611-9785-a5166686094b
 14 9d9160b0-da88-66ce-99ad-1e1c3e7264fd
 15 5db41464-8b07-2ceb-a770-9ae2de4d4c18
 16 01c86912-475c-540b-afea-96319e910d84
 17 73ceb62f-65ee-2fc0-8ce1-db9edf9d0b3f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 18843370807876252. Exactly this sequence comes out of new Random(89).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 78 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related